Django管理形式可以跨站請求僞造（CSRF）

Question

在我的Django管理站點，我運行漏洞測試進行操作，並顯示以下威脅：

An effective CSRF (Cross-Site Request Forgery) countermeasure for forms is to 
include a hidden field with a random value specific to the user's current session. 
A form was detected that did not appear to contain an anti-CSRF token. 
This form was tested for susceptibility to a CSRF attack and determined to be vulnerable. 

我在管理頁面查詢; CSRF已經確定。

Answer 1

自動工具通常會給Django的CSRF保護帶來誤報。 Django安全團隊得到了許多這樣的無效報告。