Django, CSRF protection and js generated form
- by Neewok
I have to create a form dynamically via javascript (yeah, that sounds ugly, but read this for the reason) and wants to make its submission CSRF proof.
Usually, I use the @csrf_protect decorator in my views, and the {% csrf_token %} tag in my templates, as recommanded in the doc.
But what should I do with a client-side generated form ? If I add a '/get_token/' view to generate a token on the server and obtain its value (say, via JSONP), then that means that I'm creating a backdoor an attacker could use to bypass the protection.
Kinda head-scratching.
What would you recommand ?
