3 ms·

Django is vulnerable to cookie forcing. BREACH is not needed, CSRF token can be replaced with active MITM