How do we validate POST endpoint requests that have JSON payload?

[asuraphel]

ValidateFormSubmission reads the CSRF token from formData. I agree that preventing CSRF is a great idea but shouldn't it be a different concern just like Django does it( allows you to opt out with the decorator nocsrf.

[pilcrowonpaper]

You can use validateRequest, which checks for the access token in the authorization header. With v0.10.0, you'll be able to opt out of the default header based CSRF protection.

[asuraphel]

The documentation says validateRequest doesn't work with POST requests, right?

[pilcrowonpaper]

No, that's validateRequestByCookie