I'm working on a plugin that'll create a private API for content authors to post entries to Craft from desktop-based scripts. These scripts post data to plugin controller actions (anonymous-allowed), where the plugin will first check for valid Craft user account details or a plugin-generated key.
Since I'm still enforcing authentication, what's the best way to disable CSRF checks just for these posts when CSRF is globally enabled?
Thoughts I've had:
- Attempt to put the CSRF key and token in the $_POST data as early as possible. (Probably not even possible.)
- Have the client (desktop) script grab the CSRF key+token just before posting. (Inconvenient, potentially failure-prone.)
- Somehow prevent CSRF protection from being enabled for requests passed to this controller.