learning-unlimited/ESP-Website — comment on commit 07ba05117e36874a4ee01cfb42122b1c68c3a23d
File: esp/public/media/scripts/csrf_check.js line 26
By gkanwar:

Ah, I see your point about the javascript stuff. Would it be worth it to move the code from csrf_init to csrf_check in that case? That could speed things up slightly by adding the csrftoken only as submissions happen.

With regards to preventing adding the CSRF token to forms submitting to untrusted sites, are there any trusted sites besides the site the code is running on? Also what would be a good way to check this?