Python中的CSRF攻击与第三方利用授权

from django.views.decorators.csrf import csrf_exempt

@csrf_exempt
def my_view(request):
    # ...

<form action="/submit/" method="post">
    {% csrf_token %}
    <input type="text" name="name" value="pidancode.com">
    <button type="submit">提交</button>
</form>

CSRF_COOKIE_DOMAIN = None
CSRF_COOKIE_NAME = 'csrftoken'
CSRF_COOKIE_PATH = '/'
CSRF_COOKIE_SECURE = False
CSRF_FAILURE_VIEW = 'django.views.csrf.csrf_failure'
CSRF_HEADER_NAME = 'HTTP_X_CSRFTOKEN'
CSRF_TRUSTED_ORIGINS = []

import requests
from requests_oauthlib import OAuth1

# Step 1: 获得request token
twitter_consumer_key = 'your_consumer_key'
twitter_consumer_secret = 'your_consumer_secret'
oauth = OAuth1(twitter_consumer_key, client_secret=twitter_consumer_secret)
response = requests.post('https://api.twitter.com/oauth/request_token', auth=oauth)
if response.status_code == 200:
    request_token = dict(response.content.decode().split('&'))
    auth_url = 'https://api.twitter.com/oauth/authenticate?' + request_token['oauth_token']
    print('请在浏览器中打开以下链接并授权：')
    print(auth_url)
    oauth_token = input('请输入授权后的oauth_token：')
    oauth_verifier = input('请输入oauth_verifier：')
    # Step 3: 获得access token
    oauth = OAuth1(twitter_consumer_key,
                   client_secret=twitter_consumer_secret,
                   resource_owner_key=request_token['oauth_token'],
                   resource_owner_secret=request_token['oauth_token_secret'],
                   verifier=oauth_verifier)
    response = requests.post('https://api.twitter.com/oauth/access_token', auth=oauth)
    if response.status_code == 200:
        access_token = dict(response.content.decode().split('&'))
        print('access_token:', access_token)
    else:
        print('获得access token失败！状态码：', response.status_code)
else:
    print('获得request token失败！状态码：', response.status_code)