During a penetration test of a Django application, an apparent CSRF bypass was discovered where arbitrary token values were accepted. This turns out to be by design: Django uses a double submit cookie pattern with masking, verifying only that the cookie and form token match rather than validating server-issued origin. The post
Table of contents
ObservationUnderstanding Django’s CSRF DesignToken GenerationWhy It’s Still PassedGet Windasunny ’s stories in your inboxSecurity ImplicationsRecommended HardeningKey TakeawaysFinal ThoughtsReferenceSort: