If a csrf token is set in the headers and validated in the backend, is there anyway an attacker can perform a successful csrf attack?
As mentioned in the title, how would you go about launching a csrf attack if the header carries the csrf token? Is it possible if the attacker has a copy of the token but cannot be passed as part of the POST payload. submitted by /u/Mr-F…