How can I protect my Single Page Application against CSRF

Question

I'm building a single page app with vue js on the frontend and laravel on the backend.

I have a couple of contact forms for guests. I made a script to make post requests with data to the laravel api endpoint.

How can I prevent this from users abusing ? Besides Google Recaptcha is there another way ?

Answer 1

You don't use csrf token in single page application. You need to use a jwt auth / token, which you sent on each request. Single Page Application do not have a session like a normal Laravel application would have so.

Look at following thread , this answer describes it good I think:

Generally, CSRF happens when a browser automatically adds headers (ie: Session ID within a Cookie), and then made the session authenticated. Bearer tokens, or other HTTP header based tokens that need to be added manually, would prevent you from CSRF.