3 ms·
Many frameworks have had and probably still have bugs in their CSRF handling. E.g. a quick scan on the Django security issues [1] shows 5 issues involving CSRF,
by pg314 10y ago
Many frameworks have had and probably still have bugs in their CSRF handling. E.g. a quick scan on the Django security issues [1] shows 5 issues involving CSRF, the latest one in September 2016.
[1] https://docs.djangoproject.com/en/1.10/releases/security/ https://docs.djangoproject.com/en/1.10/releases/security/
- Eridrus 10y agoSure, the fact that browser vendors have better security sense than framework developers is a plus, but it's not going to be an improvement on the rest. Most people aren't getting hacked via an obscure Google Analytics + Django CSRF interaction. Not people are getting hacked via client-side webapp vulns of any sort anyway.
- huxley 10y agoNote: 5 issues including advisories since 2008