Web Security · Middle · Question 27 of 75

An API accepts only `Content-Type: application/json`. Why does that make classic CSRF harder?

1Because JSON can't be sent over HTTP
✓Correct answer: HTML forms can't send that content type, and a cross-origin fetch with it needs a CORS preflight
3Because browsers never attach cookies to JSON requests

Explanation

This only holds if the server really rejects other content types. Some frameworks parse form bodies as JSON anyway, which reopens the hole.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.