To protect against cross-site request forgery attacks, a default PingAM installation requires that some requests,...

Cross-Site Request Forgery (CSRF) is an attack where a malicious site sends a request to PingAM using the victim's authenticated browser session. Because standard HTML forms and cross-site requests cannot easily set custom HTTP headers, requiring a specific header is an effective defense for REST APIs.

According to the PingAM "Security" documentation and the "REST API" reference:

By default, PingAM 8.0.2 enforces a CSRF filter on its REST endpoints (such as /json/authenticate or /json/users). For any "state-changing" request (like a POST, PUT, or DELETE), the client must prove the request is intentional and not a forged browser-driven request. This is achieved by requiring at least one of the following headers:

X-Requested-With: Commonly used by AJAX libraries like jQuery. Its presence indicates the request was made via a script, which is generally not possible for a standard cross-site CSRF attack.

Accept-API-Version: This header serves two purposes. First, it ensures the client is targeting a specific version of the PingAM REST API (e.g., resource=2.0, protocol=1.0). Second, since custom headers cannot be set in simple cross-site

submissions, it acts as aCSRF token.

If a POST request is sent to the REST API without one of these headers, PingAM will reject the request with a403 Forbiddenerror, even if the user has a valid session cookie.

Option B (If-Match: _rev)is used for concurrency control (preventing "lost updates" in IDM or AM configuration), but it is not the primary CSRF defense.Options A and Dare headers sometimes used for "Zero-Page Login" or legacy authentication, but they do not provide protection against CSRF for the general REST API. Therefore, the combination ofX-Requested-WithorAccept-API-Versionis the correct answer for default CSRF protection in PingAM 8.0.2.