1) only to make sure we are on the same page. Now I see - we have different understanding of "session". >Not all sites use sessions (some for performance reaso

1) only to make sure we are on the same page. Now I see - we have different understanding of "session". >Not all sites use sessions (some for performance reasons, others for privacy reasons); what kind of site doesn't use sessions? To track a user you need a cookie right? 2) Frameworks != sites. As I used to think, only framework is responsible for CSRF protection, hence I extrapolated. I sent it to security@ as soon as I found this email. I am trying to not proclaim anything but some websites from http://www.djangosites.org/ http://www.djangosites.org/ are vulnerable.