TL;DR — with a standard config, EZproxy filters out headers with the names X-CSRF-TOKEN and X-XSRF-TOKEN. Any CSRF validation checks that require one of those headers to be present in a request will fail. What’s going on I wanted to write something about this because my googling for the terms CSRF and EZproxy…

I subscribe to the ProgMetal subreddit, because there’s nothing I like more than hearing a virtuoso play an 8-string guitar solo while assorted drummers, bassists, keyboard players, cellists and french horn players alternate bars of 19/16 and 7/4. The majority of posts on /r/ProgMetal are links to tracks on YouTube…

If your app communicates with any 3rd party APIs, it’s likely to need to use some pieces of information to identify itself, such as IDs, API keys or client secrets. …