• tfm@europe.pubEnglish
      5·
      1 天前

      It’s not just native Apps. Alternative web UIs like Thunder, Photon and Voyager need them too.

      • GreenKnight23@lemmy.worldEnglish
        1·
        1 天前

        yes, but those frontends are typically tied closer to the backend than a public API.

        things like CSRF can help block abuse of the back end.

        • tfm@europe.pubEnglish
          1·
          1 天前

          Nope they all use the public API. Even the default Lemmy web client.

          • GreenKnight23@lemmy.worldEnglish
            11·
            1 天前

            well that’s poor planning and why bots are such a problem.

            I know CSRF tokens aren’t a silver bullet, but doing nothing to stop them does nothing to stop them.

            • tfm@europe.pubEnglish
              3·
              17 小时前

              CSRF protection is a security feature not bot prevention. A bot would just need to get a token first.