Guide58.2K views1,739 votes0 replies2,502 following
CakePHP CSRF and Security protection for mixed HTML and API routes
Protect browser forms with CakePHP CSRF while keeping stateless API routes token-free. A minimal design uses CsrfProtectionMiddleware after SessionMiddleware, excludes /api/*, and relies on FormHelper for tokens.
cakephp