4 ms·
> without very refined standard methods Doesn't every mature web framework prevent CSRF out-of-the-box with default middleware?
by pphysch 3y ago
> without very refined standard methods
Doesn't every mature web framework prevent CSRF out-of-the-box with default middleware?
- marcosdumay 3y agoTo some extent, yes. There's also CORS. I'm not sure the problem can be completely solved without changes in browser behavior. And yep, that leaves 1 of the top 10 problems not being automatically solved by one-time measures. I didn't include it because differently from managed memory and strict types, I have never seen anybody fight against the use of web frameworks (just against heavy-featured ones, but the light ones also include CSRF protection).