Ping Identity PT-AM-CPE Exam - Topic 5 Question 19 Discussion

Cross-Site Request Forgery (CSRF) is an attack where a malicious site sends a request to PingAM using the victim's authenticated browser session. Because standard HTML forms and cross-site requests cannot easily set custom HTTP headers, requiring a specific header is an effective defense for REST APIs.

According to the PingAM 'Security' documentation and the 'REST API' reference:

By default, PingAM 8.0.2 enforces a CSRF filter on its REST endpoints (such as /json/authenticate or /json/users). For any 'state-changing' request (like a POST, PUT, or DELETE), the client must prove the request is intentional and not a forged browser-driven request. This is achieved by requiring at least one of the following headers:

X-Requested-With: Commonly used by AJAX libraries like jQuery. Its presence indicates the request was made via a script, which is generally not possible for a standard cross-site CSRF attack.

Accept-API-Version: This header serves two purposes. First, it ensures the client is targeting a specific version of the PingAM REST API (e.g., resource=2.0, protocol=1.0). Second, since custom headers cannot be set in simple cross-site <form> submissions, it acts as a CSRF token.

If a POST request is sent to the REST API without one of these headers, PingAM will reject the request with a 403 Forbidden error, even if the user has a valid session cookie.

Option B (If-Match: _rev) is used for concurrency control (preventing 'lost updates' in IDM or AM configuration), but it is not the primary CSRF defense. Options A and D are headers sometimes used for 'Zero-Page Login' or legacy authentication, but they do not provide protection against CSRF for the general REST API. Therefore, the combination of X-Requested-With or Accept-API-Version is the correct answer for default CSRF protection in PingAM 8.0.2.