Python中的CSRF攻击与安全头部设置

# 生成CSRF Token并存储到会话中
import secrets
from flask import session

@app.route('/')
def index():
    token = secrets.token_hex(16)
    session['csrf_token'] = token
    return render_template('index.html', csrf_token=token)

# 验证要求头部中的Token和会话中的Token会不会一致
from flask import request

@app.route('/submit', methods=['POST'])
def submit():
    if request.headers.get('X-CSRF-TOKEN') != session['csrf_token']:
        return 'Invalid CSRF Token'
    # 业务逻辑处理
    return 'Submit Succeeded'

from flask import request

@app.route('/submit', methods=['POST'])
def submit():
    referer = request.headers.get('Referer')
    if not referer or 'pidancode.com' not in referer:
        return 'Invalid Referer'
    # 业务逻辑处理
    return 'Submit Succeeded'