To protect against cross-site request forgery attacks, a default PingAM installation requires that some requests, such as POST requests, include:

PingAM implements a Cross-Site Request Forgery (CSRF) protection mechanism for its REST endpoints. By default, it requires that state-changing requests (e.g., POST, PUT, DELETE) include a non-standard header that a browser would not automatically add to a cross-origin request initiated by a simple HTML form. The presence of a header like X-Requested-With (commonly added by JavaScript libraries for AJAX requests) or Accept-API-Version serves as an indication that the request is legitimate and not part of a CSRF attack.

A. The X-OpenAM-Password header is used for direct authentication to the REST API, not for CSRF protection.

B. The If-Match: rev header is used for concurrency control and preventing lost updates, not for CSRF mitigation.

D. The X-OpenAM-Username header is part of the authentication mechanism for the REST API, not a CSRF countermeasure.

1. Ping Identity, PingAM Documentation, "Security Guide," Chapter: "Preventing Common Vulnerabilities," Section: "Cross-Site Request Forgery." This section explicitly describes the CSRF protection mechanisms, including the requirement for custom headers on REST API calls.

2. Ping Identity, PingAM Documentation, "REST API Reference," Section: "API Security," Subsection: "CSRF Protection." This part of the documentation details that for requests that change state, a CSRF token or a specific header like X-Requested-With is required.