Django管理形式可以跨站请求伪造（CSRF）

Question

在我的Django管理站点，我运行漏洞测试进行操作，并显示以下威胁：

An effective CSRF (Cross-Site Request Forgery) countermeasure for forms is to 
include a hidden field with a random value specific to the user's current session. 
A form was detected that did not appear to contain an anti-CSRF token. 
This form was tested for susceptibility to a CSRF attack and determined to be vulnerable. 

我在管理页面查询; CSRF已经确定。

Answer 1

自动工具通常会给Django的CSRF保护带来误报。 Django安全团队得到了许多这样的无效报告。