The default protects cookie-backed browser routes from cross-origin unsafe
requests while still allowing server-to-server calls and tests that do not
send browser origin headers. Set allowMissingOrigin: false and configure
token for stricter browser-only APIs.
Create CSRF protection for unsafe HTTP methods.
The default protects cookie-backed browser routes from cross-origin unsafe requests while still allowing server-to-server calls and tests that do not send browser origin headers. Set
allowMissingOrigin: falseand configuretokenfor stricter browser-only APIs.