CSRF protection disabled (ARCH2125)

Ce contenu n’est pas encore disponible dans votre langue.

Key python.security.disabled-csrf · Severity warning · Category security · CWE CWE-352

Disabling CSRF protection on state-changing endpoints lets attackers trigger unwanted requests using a victim’s session. Protection should be removed only when it is genuinely unnecessary.

Incorrect

from django.views.decorators.csrf import csrf_exempt

@csrf_exempt
def transfer(request):
    move_funds(request.POST["to"], request.POST["amount"])

Correct

def transfer(request):
    # CSRF token validated automatically by middleware
    move_funds(request.POST["to"], request.POST["amount"])

Fix

Keep CSRF protection enabled; do not use @csrf_exempt on state-changing endpoints.