API CSRF protection
<p>I have an app that consists of simple JSON API and React frontend. Authentication is handled via cookies and frontend is served from the same domain I use for API. Since I don't allow CORS, wonder if API is going to be protected against CSRF attacks if it accepts only requests with some custom header, for example if <code>X-Requested-With</code> is set to <code>XMLHttpRequest</code>?</p>