{"id":7638,"date":"2026-08-10T12:43:31","date_gmt":"2026-08-10T11:43:31","guid":{"rendered":"https:\/\/churchtools.academy\/?post_type=docs&#038;p=7638"},"modified":"2026-08-24T12:48:02","modified_gmt":"2026-08-24T11:48:02","password":"","slug":"csrf-prevention","status":"publish","type":"docs","link":"https:\/\/staging.churchtools.academy\/de\/help\/system-einstellungen\/allgemein-datenschutz-sicherheit\/csrf-prevention\/","title":{"rendered":"CSRF-Prevention"},"content":{"rendered":"\n<aside class=\"wp-block-group ct-box ct-box-blue has-background is-vertical is-layout-flex wp-container-core-group-is-layout-1ccdadb1 wp-block-group-is-layout-flex\" style=\"border-radius:8px;border-left-color:#3e70ce;border-left-width:0.5rem;background-color:#f3f5f7;margin-top:var(--wp--preset--spacing--60);margin-bottom:var(--wp--preset--spacing--60)\">\n<p class=\"wp-block-paragraph\" style=\"margin-top:0.5rem;margin-right:0.5rem;margin-bottom:0rem;margin-left:0.5rem\"><strong>Hinweis<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"margin-top:0rem;margin-right:0.5rem;margin-bottom:0.5rem;margin-left:0.5rem\">Der CSRF-Token ist f\u00fcr die alte AJAX API relevant. Solltest du die REST-API verwenden, ist dieser Token nicht notwendig.<\/p>\n<\/aside>\n\n\n\n<p class=\"wp-block-paragraph\">CSRF steht f\u00fcr <a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Glossary\/CSRF\">Cross-Site-Request-Forgery<\/a> und beschreibt eine Attacke, in der man\u00a0\u00fcber einen Benutzer ungewollte Aktionen ausl\u00f6st, um deren Rechte zu missbrauchen. Damit ChurchTools nicht anf\u00e4llig f\u00fcr CSRF-Attacken ist, haben wir einen CSRF-Token eingef\u00fchrt. Dieser muss bei allen AJAX API-Aufrufen als Header mitgeschickt werden. Genauer gesagt betrifft das alle <em>POST-Requests<\/em>, die den Content-Type <code>application\/x-www-form-urlencoded<\/code> oder <code>multipart\/form-data<\/code> gesetzt haben.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nachdem du authentifiziert bist, rufst du die API <code>\/api\/csrftoken<\/code> auf, um den Token zu bekommen. Diesen Token sendest du dann bei jedem folgenden API-Request als Header mit. Der Header sieht folgenderma\u00dfen aus:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><code>CSRF-Token: $MEIN_TOKEN<\/code><\/code><\/pre>\n\n\n\n<aside class=\"wp-block-group ct-artikel-zum-weiterlesen has-background is-layout-constrained wp-container-core-group-is-layout-79a8db7e wp-block-group-is-layout-constrained\" style=\"border-radius:8px;background-color:#f9fafb;margin-top:24px;margin-bottom:24px;padding-top:32px;padding-right:24px;padding-bottom:32px;padding-left:24px\">\n<h4 class=\"wp-block-heading has-medium-font-size\">Artikel zum Weiterlesen<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/staging.churchtools.academy\/de\/help\/system-einstellungen\/api\/uberblick-api\/\" type=\"docs\" id=\"7251\">\u00dcberblick API<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/staging.churchtools.academy\/de\/help\/system-einstellungen\/api\/api-alt\/\" data-type=\"docs\" data-id=\"7254\">API-Alt<\/a><\/li>\n<\/ul>\n<\/aside>\n","protected":false},"excerpt":{"rendered":"<p>CSRF steht f\u00fcr Cross-Site-Request-Forgery und beschreibt eine Attacke, in der man\u00a0\u00fcber einen Benutzer ungewollte Aktionen ausl\u00f6st, um deren Rechte zu missbrauchen. Damit ChurchTools nicht anf\u00e4llig f\u00fcr CSRF-Attacken ist, haben wir einen CSRF-Token eingef\u00fchrt. Dieser muss bei allen AJAX API-Aufrufen als Header mitgeschickt werden. Genauer gesagt betrifft das alle POST-Requests, die den Content-Type application\/x-www-form-urlencoded oder multipart\/form-data [&hellip;]<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"doc_category":[412],"doc_tag":[],"knowledge_base":[346],"class_list":["post-7638","docs","type-docs","status-publish","hentry","doc_category-allgemein-datenschutz-sicherheit","knowledge_base-system-einstellungen"],"pp_statuses_selecting_workflow":false,"pp_workflow_action":"current","pp_status_selection":"publish","pp_force_visibility":null,"pp_subpost_visibility":null,"pp_inherited_force_visibility":null,"pp_inherited_subpost_visibility":null,"acf":[],"year_month":"2026-08","word_count":108,"total_views":"2824","reactions":{"happy":"0","normal":"0","sad":"0"},"author_info":{"name":"Victoria Weidemann","author_nicename":"vweidemann","author_url":"https:\/\/staging.churchtools.academy\/de\/author\/vweidemann\/"},"doc_category_info":[{"term_name":"Allgemein","term_url":"https:\/\/staging.churchtools.academy\/de\/help\/system-einstellungen\/allgemein-datenschutz-sicherheit\/"}],"doc_tag_info":[],"knowledge_base_info":[{"term_name":"System-Einstellungen","term_url":"https:\/\/staging.churchtools.academy\/de\/help\/system-einstellungen\/","term_slug":"system-einstellungen"}],"knowledge_base_slug":["system-einstellungen"],"_links":{"self":[{"href":"https:\/\/staging.churchtools.academy\/de\/wp-json\/wp\/v2\/docs\/7638","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/staging.churchtools.academy\/de\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/staging.churchtools.academy\/de\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/staging.churchtools.academy\/de\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/staging.churchtools.academy\/de\/wp-json\/wp\/v2\/comments?post=7638"}],"version-history":[{"count":8,"href":"https:\/\/staging.churchtools.academy\/de\/wp-json\/wp\/v2\/docs\/7638\/revisions"}],"predecessor-version":[{"id":90130,"href":"https:\/\/staging.churchtools.academy\/de\/wp-json\/wp\/v2\/docs\/7638\/revisions\/90130"}],"wp:attachment":[{"href":"https:\/\/staging.churchtools.academy\/de\/wp-json\/wp\/v2\/media?parent=7638"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/staging.churchtools.academy\/de\/wp-json\/wp\/v2\/doc_category?post=7638"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/staging.churchtools.academy\/de\/wp-json\/wp\/v2\/doc_tag?post=7638"},{"taxonomy":"knowledge_base","embeddable":true,"href":"https:\/\/staging.churchtools.academy\/de\/wp-json\/wp\/v2\/knowledge_base?post=7638"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}