CSRF Protection in Custom Components
We are using custom search on our forums where we are pulling in results from another server. This makes it vulnerable to CSRF attack. how can we go about implementing the CSRF protection in the lith...
Forum Discussion
1. Yes, we have control over the data, it is hosted on the SOLR server.
2. Format could be xml, json
3. Displaying it via JavaScript, in the search results.
Basically, We need to add it on the custom search page.
2. Format could be xml, json
3. Displaying it via JavaScript, in the search results.
Basically, We need to add it on the custom search page.
Based on what you've said, I can't see you needing to do anything special to avoid XSS. There's nothing inherently insecure about making cross-site requests, and you control both the content and the mechanism for displaying it on the page.
I'd recommend getting someone knowledgeable to review the code if you have any concerns about it.
