I'm curious if Appwrite implements some kind of defense mehanism against Cross-Site Request Forgery attacks?
This question is tied to the method or libraries Appwrite uses in client-side SDK-s to communicate with the Appwrite backend server. For Web SDK for instance, if the communication channel is implemented using the builtin fetch() coroutine, then CSRF protection must be configured manually. If a library like Axios is used, then CSRF protection is automatic, because Axios has it builtin. Therefore my question is, does Appwrite use the builtin fetch() coroutine and if it does, then has CSRF protection been implemented by the Appwrite team?
TL;DR
The user is asking if Appwrite implements CSRF protection in its SDKs. The response from Appwrite states that custom headers are required in the request, making it unlikely to be susceptible to CSRF attacks. The user is encouraged to create a proof of concept (POC) if they find any security vulnerabilities and share them with Appwrite. Solution: Appwrite requires custom headers in the request, offering built-in protection against CSRF attacks.
