title: Are JSON web services vulnerable to CSRF attacks?
body: <p>I am building a web service that exclusively uses JSON for its request and response content (i.e., no form encoded payloads).</p>
  
  <p><strong>Is a web service vulnerable to CSRF attack if the following are true?</strong></p>
  
  <ol>
  <li><p>Any <code>POST</code> request without a top-level JSON object, e.g., <code>{"foo":"bar"}</code>, will be rejected with a 400. For example, a <code>POST</code> request with the content <code>42</code> would be thus rejected.</p></li>
  <li><p>Any <code>POST</code> request with a content-type other than <code>application/json</code> will be rejected with a 400. For example, a <code>POST</code> request with content-type <code>application/x-www-form-urlencoded</code> would be thus rejected.</p></li>
  <li><p>All GET requests will be <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html" rel="noreferrer">Safe</a>, and thus not modify any server-side data.</p></li>
  <li><p>Clients are authenticated via a session cookie, which the web service gives them after they provide a correct username/password pair via a POST with JSON data, e.g. <code>{"username":"user@example.com", "password":"my password"}</code>.</p></li>
  </ol>
  
  <p>Ancillary question: Are <code>PUT</code> and <code>DELETE</code> requests ever vulnerable to CSRF? I ask because it seems that most (all?) browsers disallow these methods in HTML forms.</p>
  
  <p>EDIT: Added item #4.</p>
  
  <p>EDIT: Lots of good comments and answers so far, but no one has offered a specific CSRF attack to which this web service is vulnerable.</p>