# CSRF cors bypass

If csrf protection is dependent upon application/json body which always trigger cors. this can potentially be bypassed&#x20;

if content-type header is missing and it's processed

here: <https://nastystereo.com/security/cross-site-post-without-content-type.html>

<figure><img src="https://1775328623-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcqyroGfei3tKtTi25FT7%2Fuploads%2Fl30sfOQXAdOHBddvLgp9%2Fimage.png?alt=media&#x26;token=f2e68f81-06ef-43ed-9975-eeeb5f7ca773" alt=""><figcaption></figcaption></figure>
