Python中的CSRF攻击与浏览器安全策略

from flask_wtf.csrf import CSRFProtect
from flask_wtf import FlaskForm
from wtforms import StringField

app = Flask(__name__)
app.secret_key = 'secret'
csrf = CSRFProtect(app)

class MyForm(FlaskForm):
    name = StringField('name')

@app.route('/form', methods=['GET', 'POST'])
def my_form():
    form = MyForm()
    if form.validate_on_submit():
        return 'Hello, ' + form.name.data
    return render_template('myform.html', form=form)

from urllib.request import urlopen, Request
from urllib.parse import urlencode

url = 'http://localhost:5000/form'
data = {'name': 'pidancode.com'}
data = urlencode(data).encode('utf⑻')
req = Request(url, data, method='POST')
response = urlopen(req)
print(response.read())