# CSRF for Rest API

**URL:** <https://discourse.slimframework.com/t/csrf-for-rest-api/4214>\
**Category:** Questions\
**Created:** [June 6, 2020, 8:16pm UTC](https://discourse.slimframework.com/t/csrf-for-rest-api/4214 "2020-06-06T20:16:46Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Awilum](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/awilum/32/900_2.png) [@Awilum](https://discourse.slimframework.com/u/Awilum)\
**Post date:** [June 6, 2020, 8:16pm UTC](https://discourse.slimframework.com/t/csrf-for-rest-api/4214/1 "2020-06-06T20:16:46Z")

</div>

Hello!

I am using in my project that is hosted on one domain such code example:

```auto
$app->post('/api/myEndPoint',function ($request, $response, $args) {
    //Do my Things Securely!
})->add('csrf');

```

it is okey

but how to get and send csrf from another domain to this endpoint ?  
is there some examples or ides how to do this ?  
or it is no need to do this for request from another domain ?

---

<div class="post-metadata">

**Author:** ![Awilum](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/awilum/32/900_2.png) [@Awilum](https://discourse.slimframework.com/u/Awilum)\
**Post date:** [June 7, 2020, 1:15pm UTC](https://discourse.slimframework.com/t/csrf-for-rest-api/4214/3 "2020-06-07T13:15:16Z")

</div>

I am not understand you answer on my question in this topic

---

<div class="post-metadata">

**Author:** ![odan](https://avatars.discourse-cdn.com/v4/letter/o/9de053/32.png) [@odan](https://discourse.slimframework.com/u/odan)\
**Post date:** [June 7, 2020, 2:55pm UTC](https://discourse.slimframework.com/t/csrf-for-rest-api/4214/4 "2020-06-07T14:55:55Z")

</div>

I think my answer was not precise enough to your question, so I deleted it. 😅

---

<div class="post-metadata">

**Author:** ![darkalchemy](https://avatars.discourse-cdn.com/v4/letter/d/ad7895/32.png) [@darkalchemy](https://discourse.slimframework.com/u/darkalchemy)\
**Post date:** [June 9, 2020, 2:33am UTC](https://discourse.slimframework.com/t/csrf-for-rest-api/4214/5 "2020-06-09T02:33:24Z")

</div>

How would the other domain get the csrf value? Would it make a request to get the csrf value and then make another request with the value? I can’t see the point in that?

---

<div class="post-metadata">

**Author:** ![Awilum](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/awilum/32/900_2.png) [@Awilum](https://discourse.slimframework.com/u/Awilum)\
**Post date:** [June 9, 2020, 6:41am UTC](https://discourse.slimframework.com/t/csrf-for-rest-api/4214/6 "2020-06-09T06:41:48Z")

</div>

okey, I see. csrf is not for Rest API

---

<div class="post-metadata">

**Author:** ![darkalchemy](https://avatars.discourse-cdn.com/v4/letter/d/ad7895/32.png) [@darkalchemy](https://discourse.slimframework.com/u/darkalchemy)\
**Post date:** [June 9, 2020, 4:24pm UTC](https://discourse.slimframework.com/t/csrf-for-rest-api/4214/7 "2020-06-09T16:24:21Z")

</div>

I apologize if my reply came across as rude. After re-reading it, it sounded like it to me.

---

<div class="post-metadata">

**Author:** ![abdo.host](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/abdo.host/32/781_2.png) [@abdo.host](https://discourse.slimframework.com/u/abdo.host)\
**Post date:** [June 17, 2020, 10:01pm UTC](https://discourse.slimframework.com/t/csrf-for-rest-api/4214/8 "2020-06-17T22:01:08Z")

</div>

May to help you this

# CSRF (Cross-Site Request Forgery)

[https://notes.enovision.net/slim/extras/csrf-cross-site-request-forgery](https://notes.enovision.net/slim/extras/csrf-cross-site-request-forgery)