It’s very easy to see if it can be a security issue, just ask, “if I knew the route to where to direct a post request, along with a certain payload” would I be able to trigger it’s side effects? Then depending on the side-effects it will be or not a security issue.
If to make the request produce its side effects I require information that is temporary and changing in nature and not available to me (a JWT token, a session token, a payload signature) then it’s safe (up to a reasonable expectation) I would say

This token is created and maintained by Phoenix through requests, and in:

pipeline :browser do
    plug :accepts, ["html"]
    plug :fetch_session
    plug :fetch_flash
    plug :protect_from_forgery
    plug :put_secure_browser_headers
    plug CORSPlug
  end

The protect_from_forgery plug line is what checks that they match. It’s not the same as your JWT token.

In your case I assume you want to keep the CSRF protection (you have regular pages and not an API only backend) but at the same time you want to test it from an external program that just emits requests. In this case you can temporarily comment out the plug line in the router pipeline (which is fine if you remember to put it back and just want to try some quick test).

If you want to use this in tests more systematically then you can also [disable csrf for testing] purposes (Plug.CSRFProtection — Plug v1.20.2)

@amnu3387 I was in smilar situation as topic owner. I get a post request from a third party api. I created new pipeline without protect_from_forgery . Is that security issue?. Example of my controller.

	request =[
    processId: get_session(conn, :current_process_id),
        token: get_session(conn, :token)
    ]

    json_respond = MyApp.ThirdPartyApiCient.check_process(request)
    {:ok, respond } = JSON.decode(json_respond)

    if respond["status"] == "SUCCESS" do
    ...