Support CSRF token per default only via header

[LukasReschke]

Currently ownCloud tries to read the CSRF token from GET and POST per default. - While this is per-se not a security bug this creates another attack vector.

Due to the Same-Origin-Policy websites on another domain cannot send arbitrary headers to other sites. However, they can pass arbitrary POST or GET parameters.

We should per default only read the requesttoken from the header and give the app developers to opt-in in-case they want to read this also from other sources. (This could be done using the AppFramework)

Probably we may encounter some problems with the EventSource…

[LukasReschke]

Replaced by #24092

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.