CakePHP CSRF and Security protection for mixed HTML and API routes
Protect browser forms with CakePHP CSRF while keeping stateless API routes token-free. A minimal design uses CsrfProtectionMiddleware after SessionMiddleware, excludes /api/*, and relies on FormHelper for tokens.
cakephp