Implement better CSRF token #4

New issue

Open

opened 2023-06-08 02:28:50 -05:00 by getdatakick · 0 comments

getdatakick commented

2023-06-08 02:28:50 -05:00

(Migrated from github.com)

Current token is constant, same for all visitors, and valid forever.

We should implement new mechanism that would generate unique token for every visitor. Token could be used only once, and then replaced with a new one.

This will not fix the spam issue, but it could help with 'dumb' bots.

Current token is constant, same for all visitors, and valid forever. We should implement new mechanism that would generate unique token for every visitor. Token could be used only once, and then replaced with a new one. This will not fix the spam issue, but it could help with 'dumb' bots.