blob: 043144c1b0bb6f3805dfbddd796c0b0742df5640 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
|
# Working with AJAX and CSRF
> "Take a close look at possible CSRF / XSRF vulnerabilities on your own websites. They're the worst kind of vulnerability -- very easy to exploit by attackers, yet not so intuitively easy to understand for software developers, at least until you've been bitten by one."
>
> — [Jeff Atwood][cite]
* Explain need to add CSRF token to AJAX requests.
* Explain deferred CSRF style used by REST framework
* Why you should use Django's standard login/logout views, and not REST framework view
[cite]: http://www.codinghorror.com/blog/2008/10/preventing-csrf-and-xsrf-attacks.html
|
