Python中的CSRF攻击与表单验证

pip install flask
pip install wtforms

from flask import Flask, render_template, request
from wtforms import Form, StringField, PasswordField, validators

# 创建一个Flask利用
app = Flask(__name__)

# 配置密钥，用于WTForms的CSRF保护
app.config['SECRET_KEY'] = 'secret_key'

# 创建一个表单类，包括一个用户ID和一个密码字段
class LoginForm(Form):
    user_id = StringField('User ID', [validators.Length(min=4, max=25)])
    password = PasswordField('Password', [validators.Length(min=6, max=35)])

# 处理表单提交要求
@app.route('/', methods=['GET', 'POST'])
def login():
    form = LoginForm(request.form)
    if request.method == 'POST' and form.validate():
        # 如果表单通过验证，则返回提交的数据
        return 'User ID: {}, Password: {}'.format(form.user_id.data, form.password.data)
    # 如果是GET要求，则返回包括表单的HTML页面
    return render_template('login.html', form=form)

if __name__ == '__main__':
    app.run()

{% extends "base.html" %}

{% block content %}
  <form method="POST" action="/">
    {{ form.hidden_tag() }}
    <div>
      {{ form.user_id.label }}
      {{ form.user_id }}
      {% if form.user_id.errors %}
        <ul>
          {% for error in form.user_id.errors %}
          <li style="color: red;">{{ error }}</li>
          {% endfor %}
        </ul>
      {% endif %}
    </div>
    <div>
      {{ form.password.label }}
      {{ form.password }}
      {% if form.password.errors %}
        <ul>
          {% for error in form.password.errors %}
          <li style="color: red;">{{ error }}</li>
          {% endfor %}
        </ul>
      {% endif %}
    </div>
    <div>
      <input type="submit" value="Submit">
    </div>
  </form>
{% endblock %}