143 reputation
3
bio website
location New York, United States
age
visits member for 4 months
seen Mar 27 at 15:03

Dec
18
awarded  Scholar
Dec
18
awarded  Supporter
Dec
18
accepted Is Django's built-in CSRF protection enough?
Dec
17
awarded  Student
Dec
17
comment Is Django's built-in CSRF protection enough?
I'm not sure it's something new. It looks like they're implementing a Session-Independant Nonce (cf page 5 seclab.stanford.edu/websec/csrf/csrf.pdf) in which case that is a known security flaw of this implementation.
Dec
17
asked Is Django's built-in CSRF protection enough?