Why is CSRF only applicable to web services with browser clients?

Please note: although I mentioned Spring/Java here, I believe this is a pure CSRF/websec question at heart, and can be answered by anybody with CSRF/websec experience, regardless of their familiarity with Java or Spring! --- Spring Boot & Spring Security here. The Spring docs state: Our recommendation is to use CSRF protection for any request that could be processed by a browser by normal users. If you are only creating a service that is used by non-browser clients, you will likely want to disable CSRF protection. I'm interested in why? Why is it OK to disable CSRF protection when building a service whose only clients are non-browsers, but it should be enabled when the service talks to browser clients?
http://dlvr.it/Rzwlml

No comments:

Post a Comment