learning-unlimited/ESP-Website — comment on commit 07ba05117e36874a4ee01cfb42122b1c68c3a23d
File: esp/public/media/scripts/csrf_check.js line 26
By gkanwar:

Btw the implementation I'm going for is to add csrfmiddlewaretokens in csrf_init. In this portion of the code I think it should still be like this, because the whole point of CSRF is to check against forms that come in without csrfmiddlewaretokens. We shouldn't just add them to all forms that get submitted (I can't think of an extremely obvious way to exploit this at the moment, but I feel like it definitely is possible with some fiddling if we do add csrfmiddlewaretokens every time this function is called).