3 ms·
you can use same-site cookie attribute to prevent csrf attacks these days.
by dzonga 5y ago
you can use same-site cookie attribute to prevent csrf attacks these days.
- leephillips 5y agoNot an ideal defense, as explained at https://portswigger.net/web-security/csrf/samesite-cookies https://portswigger.net/web-security/csrf/samesite-cookies But there are many things the programmer can do to defend against csrf attacks. But you have to know about the problem and know how to defend against it. When I made my first Django site 20 years ago I hadn’t even heard of csrf, yet was protected against it by the framework. It has many such benefits included, so you can make a secure site while knowing little about web security. And an efficient one: it caches DB data for you, for example. On the downside, as others have mentioned, it’s built using Python class inheritance magic, so can be a headache to modify its behavior.