Python中的CSRF攻击与Session管理

pip install flask-wtf

from flask_wtf.csrf import CSRFProtect

app = Flask(__name__)

# 自定义密钥
app.config['SECRET_KEY'] = 'my secret key!'

# 启用CSRF保护
csrf = CSRFProtect(app)

<form method="post" action="/submit">
  {{ form.hidden_tag() }}
  <input type="text" name="username">
  <input type="password" name="password">
  <button type="submit">提交</button>
</form>

from flask_wtf import FlaskForm
from wtforms import StringField, PasswordField, SubmitField
from wtforms.validators import DataRequired

class LoginForm(FlaskForm):
    username = StringField('用户名', validators=[DataRequired()])
    password = PasswordField('密码', validators=[DataRequired()])
    submit = SubmitField('登录')

from flask import Flask, render_template, request, flash, redirect
from .forms import LoginForm

app = Flask(__name__)
app.config['SECRET_KEY'] = 'my secret key!'

@app.route('/login', methods=['GET', 'POST'])
def login():
    form = LoginForm()
    if form.validate_on_submit():
        username = form.username.data
        password = form.password.data
        # 验证用户名密码会不会正确
        if username == 'pidancode.com' and password == '123456':
            flash('登录成功！')
            return redirect('/')
        else:
            flash('用户名或密码毛病！')
    return render_template('login.html', form=form)

pip install flask-session

from flask import Flask
from flask_session import Session

app = Flask(__name__)

# 配置Session
app.config['SESSION_TYPE'] = 'redis'
app.config['SESSION_REDIS'] = Redis()
app.config['SESSION_COOKIE_NAME'] = 'my_cookie'
app.config['SECRET_KEY'] = 'my secret key!'

# 启用扩大
Session(app)

from flask import session, redirect, url_for

@app.route('/set_session')
def set_session():
    session['username'] = 'pidancode.com'
    return redirect(url_for('index'))

@app.route('/')
def index():
    username = session.get('username')
    return '用户名：{}'.format(username)