An attack that tricks authenticated users into performing unintended actions on a web application they're logged into.
CSRF exploits the trust a site has in a user's browser. If a user is logged into their bank, a malicious page could submit a hidden form to transfer money. Prevention includes CSRF tokens (unique per session/request), SameSite cookie attributes, and checking the Origin/Referer header.
Django's built-in CSRF middleware automatically generates and validates CSRF tokens on all POST requests.
CSRF protection is table stakes for any web application handling sensitive actions — Django and most modern frameworks include it by default.
A unique identifier used to authenticate and authorize API requests, typically passed as a header or...
A browser security mechanism that controls which domains can make requests to your API, preventing u...
A web security vulnerability that allows attackers to inject malicious scripts into web pages viewed...
A high-level Python web framework that provides an ORM, admin interface, authentication, and 'batter...
A security method requiring two or more verification factors (password + phone code, biometric, hard...
Need help implementing this in your business?
Get Started