3 ms·

Noticed that not a single website is using django. Am I missing something?

• tectonic 15y ago
  I'm not sure that there is a django matcher yet. Django is hard to reliably detect. Do you know of a good signature (like a header or form token) that it always uses?
  • lloeki 15y ago
    You could implement "maybe" matchers, that look for stuff which has a good chance of telling you what's underneath but not with 100% certainty. Now, the following is a hack, but CSRF stuff[0] gives a good indication: If there's a form, there's a good chance you'll find a construct like: <form action="." method="post"><input type='hidden' name='csrf_token' value="thetokenvalue" /> Also, there may be a 'csrftoken' value in the cookie. You will also most probably find the jQuery function that sets X-CSRFToken on XHRs (see the doc[0] at #ajax). For prototype it'll look like this [1] [0] https://docs.djangoproject.com/en/dev/ref/contrib/csrf/ https://docs.djangoproject.com/en/dev/ref/contrib/csrf/ [1] http://stackoverflow.com/questions/5551914/protecting-prototype-js-based-xhr-requests-against-csrf http://stackoverflow.com/questions/5551914/protecting-protot...