• tfm@europe.pubEnglish
      7·
      3 个月前

      It’s not just native Apps. Alternative web UIs like Thunder, Photon and Voyager need them too.

      • GreenKnight23@lemmy.worldEnglish
        11·
        3 个月前

        yes, but those frontends are typically tied closer to the backend than a public API.

        things like CSRF can help block abuse of the back end.

        • tfm@europe.pubEnglish
          3·
          3 个月前

          Nope they all use the public API. Even the default Lemmy web client.

          • GreenKnight23@lemmy.worldEnglish
            12·
            3 个月前

            well that’s poor planning and why bots are such a problem.

            I know CSRF tokens aren’t a silver bullet, but doing nothing to stop them does nothing to stop them.

            • tfm@europe.pubEnglish
              4·
              3 个月前

              CSRF protection is a security feature not bot prevention. A bot would just need to get a token first.