Cross-Site Request Forgery (CSRF)

- import { HttpClient } from '@angular/common/http';
- import { Injectable } from '@angular/core';
- 
- @Injectable({ providedIn: 'root' })
- export class UserService {
-   constructor(private http: HttpClient) {}
- 
-   getUsers() {
-     return this.http.get('/api/users', {
-       headers: { Authorization: `Bearer ${this.getToken()}` }
-     });
-   }
- 
-   updateUser(id: string, data: any) {
-     // Easy to forget auth header on new endpoints
-     return this.http.put(`/api/users/${id}`, data);
-   }
- 
-   private getToken(): string {
-     return localStorage.getItem('token') || '';
-   }
- }
+ import { Injectable } from '@angular/core';
+ import { HttpInterceptor, HttpRequest, HttpHandler, HTTP_INTERCEPTORS } from '@angular/common/http';
+ import { AuthService } from './auth.service';
+ 
+ @Injectable()
+ export class AuthInterceptor implements HttpInterceptor {
+   constructor(private auth: AuthService) {}
+ 
+   intercept(req: HttpRequest<any>, next: HttpHandler) {
+     const token = this.auth.getToken();
+     if (token) {
+       req = req.clone({
+         headers: req.headers.set('Authorization', `Bearer ${token}`)
+       });
+     }
+     return next.handle(req);
+   }
+ }
+ 
+ // In app.module.ts
+ // providers: [{ provide: HTTP_INTERCEPTORS, useClass: AuthInterceptor, multi: true }]
  

- from django.views.decorators.csrf import csrf_exempt
- from django.http import JsonResponse
- 
- @csrf_exempt
+ from django.views.decorators.csrf import csrf_protect
+ from django.http import JsonResponse
+ 
+ @csrf_protect
  def transfer_funds(request):
      amount = request.POST['amount']
      recipient = request.POST['recipient']
      process_transfer(request.user, recipient, amount)
      return JsonResponse({'status': 'transferred'})
  

  package main
  
- import "github.com/gin-gonic/gin"
- 
- func main() {
-     r := gin.Default()
+ import (
+     "os"
+     "github.com/gin-gonic/gin"
+     "github.com/utrack/gin-csrf"
+ )
+ 
+ func main() {
+     r := gin.Default()
+     r.Use(csrf.Middleware(csrf.Options{
+         Secret: os.Getenv("CSRF_SECRET"),
+     }))
      r.POST("/transfer", transferMoney)
      r.Run(":8080")
  }