title: CSRF protection and Spring Session header session strategy
body: <p>In my spring based rest API, I'm using spring-session with HeaderHttpSessionStrategy. Given cookies are not used at all (session id is sent as a header), do I still need to worry about CSRF attacks?</p>
  
  <p>I would say I'm safe, and I have read people agreeing that in this scenario CSRF protection is not needed, for example: 
  <a href="https://security.stackexchange.com/questions/62080/is-csrf-possible-if-i-dont-even-use-cookies">https://security.stackexchange.com/questions/62080/is-csrf-possible-if-i-dont-even-use-cookies</a></p>
  
  <p>However, the Spring guys argue that whenever an application is accessed by a browser you do need CSRF protection: <a href="https://spring.io/blog/2015/01/12/the-login-page-angular-js-and-spring-security-part-ii" rel="nofollow noreferrer">https://spring.io/blog/2015/01/12/the-login-page-angular-js-and-spring-security-part-ii</a>.</p>