I have a Craft 3 installation and want to add a tab/app to Facebook like domain.com/facebook
Facebook sends a post request to the configured secure tab URL. Now when Craft's CSRF protection is enabled, Craft gives an error. If I disable CSRF protection the tab shows up in Facebook.
I don't want to disable CSRF - what could i do... plugin with a controller to render the template?