title: GraphQL and CSRF protection
body: <p>I read a lot around:</p>
  
  <ol>
  <li><a href="https://github.com/pillarjs/understanding-csrf" rel="noreferrer">https://github.com/pillarjs/understanding-csrf</a></li>
  <li><a href="https://security.stackexchange.com/questions/10227/csrf-with-json-post">https://security.stackexchange.com/questions/10227/csrf-with-json-post</a></li>
  <li><a href="https://stackoverflow.com/questions/11008469/are-json-web-services-vulnerable-to-csrf-attacks">Are JSON web services vulnerable to CSRF attacks?</a></li>
  <li>(Nothing on the ApolloServer site: <a href="https://www.apollographql.com/docs/apollo-server/" rel="noreferrer">https://www.apollographql.com/docs/apollo-server/</a>)</li>
  </ol>
  
  <p>However, I am not yet able to understand if our endpoint ("/graphql") is protected for this type of attack or if it is necessary to protect it with solutions like this: <a href="https://github.com/expressjs/csurf" rel="noreferrer">https://github.com/expressjs/csurf</a>.</p>
  
  <p>The thing that is not clear to me is that here: <a href="https://github.com/pillarjs/understanding-csrf" rel="noreferrer">https://github.com/pillarjs/understanding-csrf</a> they say:</p>
  
  <blockquote>
    <p>When you're using CSRF tokens incorrectly:
    ...
    Adding them to JSON AJAX calls
    As noted above, if you do not support CORS and your APIs are strictly JSON, there is absolutely no point in adding CSRF tokens to your AJAX calls.</p>
  </blockquote>
  
  <p>If we restrict our endpoint to just use <code>Content-Type: application/json</code> are we safe?</p>