Is it possible to only use CSRF tokens on certain Server Actions?

[Antony]

Yes @Apple, same for me… I have server actions that are webhooks from pre-webhooks-in-Wappler days.

I was already half way through implementing CSRF tokens manually anyway…

Lots of ideas about doing it manually here…

Anti-CSRF Tokens

I have to solve a security issue that came back from the pen test done by IT security. Form submission when a user is logged in is handled by always adding User Identity step as first step for your server actions but these are forms submitted when not logged in for instance login and forgot password. The blurb form security regarding this issue: No Anti-CSRF tokens were found in a HTML submission form. A cross-site request forgery is an attack that involves forcing a victim to send an HTTP re…