What is the best way to prevent off-site submissions (CSRF)?

Code required, how to prevent data from being submitted outside the station

Reply content:

Code required, how to prevent data from being submitted outside the station

A more common approach is to generate a hashkey for each form that needs to submit data, and bring it together when you submit it.

1. Check referrer Header
2. If the user's ID is not visible to anyone other than the user, you can get the ID of the user in the request
3. Request a token,token can be a bound user, or it can be a per-request build (*)
4. After the request is submitted, the server confirms and then executes the requested action, such as a popup dialog asking the user to confirm
5. Remind users not to visit other sites while visiting your site
6. Remind users to log out in time
7. Users log out when they close the page
8. Users log out of the user at some time without action

* Token each generation compared to the headache is parallel compatibility problem, how to deal with the customer to browse the same page with multiple tabs, the behavior of each tab is consistent and needs to be handled with care. I like to compromise. Token takes a bind user + timeout, but does not bind the request in the same way. While maintaining a certain convenience, simply reduce the risk of replay attacks caused by the long-term invariant of tokens. @ Sandy

Django provides a framework for CSRF, and the default POST request requires token.

For your reference: https://docs.djangoproject.com/en/dev/ref/contrib/csrf/

Request with a token,token can consider binding the user, after submitting the request, the server confirms and then executes the request

Amount, use x-csrf-token this HTTP header ...

Personally feel that the outside of the submission can not be prevented, this is one of the questions I have asked http://segmentfault.com/q/1010000000353407, personally think that the insertion and server side of the session of the same local hash value is not, After all, chrome can modify the code locally by pressing F12, and most importantly, the server-side validation of the parameters provided by the client.

