I hope to defend against CSRF by customizing the request header

[zy010101]

Due to the poor user experience of synchronizer token pattern and double submit cookies, we would like to implement the Custom Request Headers approach mentioned in the linked document.

OWASP Cheat Sheet Series

The document also provides detailed explanations of the synchronizer token pattern and double submit cookies methods.

[zy010101]

Now, CSRF token can be carried in Header, Query, and Form. It is recommended to carry it in the Header to separate it from the business logic. For security reasons, it is advisable to prohibit carrying the CSRF token in the Query.

[chrislearn]

Done