search

maxcountryman / flask-seasurf

SeaSurf is a Flask extension for preventing cross-site request forgery (CSRF).
http://readthedocs.org/docs/flask-seasurf/
Other
190 stars 49 forks source link

Use token from Flask's session #38

Closed alanhamlett closed 11 years ago

alanhamlett commented 11 years ago

Keep csrf_token cookie for AJAX requests, but use the token from Flask's signed session cookie when validating the token.

This prevents a situation where somehow the user's csrf_token cookie was set by an attacker using Javascript.

maxcountryman commented 11 years ago

:+1: