怎样使用Python防范CSRF攻击

from flask_wtf.csrf import CSRFProtect

# 初始化CSRF保护
csrf = CSRFProtect(app)

# 在表单中添加CSRF令牌
@csrf.exempt
@app.route('/submit', methods=['POST'])
def submit():
    # 生成CSRF令牌
    csrf_token = session.get('_csrf_token', None)
    if csrf_token is None:
        csrf_token = os.urandom(16).hex()
        session['_csrf_token'] = csrf_token
    return render_template('submit.html', csrf_token=csrf_token)

<form method="POST">
  {{ csrf_token() }}
  <input type="text" name="name">
  <input type="submit">
</form>

from django.middleware.csrf import CsrfViewMiddleware

# 在中间件中添加Referer检查
class RefererCheckMiddleware(CsrfViewMiddleware):
    def _sanitize_token(self, request):
        if request.method == 'POST':
            referer = request.META.get('HTTP_REFERER', '')
            if 'pidancode.com' not in referer and '丸子编程' not in referer:
                return None
        return super()._sanitize_token(request)

MIDDLEWARE = [
    ...
    'path.to.RefererCheckMiddleware',
    'django.middleware.csrf.CsrfResponseMiddleware',
    ...
]

from flask import Flask, make_response

app = Flask(__name__)

# 设置Cookie的SameSite属性
@app.route('/')
def index():
    response = make_response('Hello, world!')
    response.set_cookie('mycookie', 'value', samesite='Lax')
    return response