API Design · Middle · Question 68 of 75

A browser SPA authenticates with cookies to its API. What extra protection is needed compared with bearer tokens?

1Nothing extra
✓Correct answer: CSRF protection: SameSite cookies plus a CSRF token or checking Origin for state-changing requests
3Encrypting every JSON field

Explanation

Browsers attach cookies automatically, even to requests triggered by other sites. Bearer tokens in headers aren't sent automatically.

Further reading

Test yourself

Take the API Design · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.