Guide58.2K views3,761 votes0 replies3,403 following
CakePHP CSRF and Security protection for mixed HTML and API routes
Protect browser forms with CakePHP CSRF while keeping stateless API routes token-free. A minimal design uses CsrfProtectionMiddleware after SessionMiddleware, excludes /api/*, and relies on FormHelper for tokens.
cakephp