core
core copied to clipboard
Need functionality to disable automatic CSRF checking
If we enable automatic CSRF checking, all REST calls will fail, unless they contain a token, which is not likely.
See https://github.com/fuel/core/pull/1974#issuecomment-183992069
How to implement it?
CodeIgniter's implementation:
$config['csrf_exclude_uris'] = array('api/person/add');
$config['csrf_exclude_uris'] = array(
'api/record/[0-9]+',
'api/title/[a-z]+'
);
https://www.codeigniter.com/user_guide/libraries/security.html#cross-site-request-forgery-csrf