This link has been bookmarked by 6 people . It was first bookmarked on 24 Sep 2008, by takayuki kawamoto.
-
-
One of the issues I ran into trying to use Django's built-in CSRF protection was that it would insert tokens only on sites with <form> elements. This means that on pages with no forms, but lots of AJAX sending POST requests, they would all be blocked. Luckily, Javascript's same-domain rules mean I can have a page like "/auth/get-csrf-token/" that simply returns the user's current token, download it with an AJAX GET, and then freely use it in POSTS.
-
-
Lindsay DonagheExplanation of and advice for handling common attacks through websites. Cross-Site Request Forgeries with a little bit of Cross-Site Scripting.
-
Kevin RigginsJeff explains very clearly how csrf attacks work.
Would you like to comment?
Join Diigo for a free account, or sign in if you are already a member.