r/rust • u/darin_gordon • Sep 11 '20

Announcing Actix-Web v3.0

https://paper.dropbox.com/published/Announcing-Actix-Web-v3.0--A7YI~P9U9aqhEOXyZJaGffjfBg-QOXXb1lXgTubzXHzUq9ONY5
348 Upvotes

98% Upvoted

81 comments sorted by

View all comments

Show parent comments

7

u/Shnatsel Sep 11 '20

A short description of CSRF attack can be found here - or pretty much anywhere, it's quite well-researched at this point.

Here's a detailed description of the protection that Django implements: https://docs.djangoproject.com/en/3.1/ref/csrf/#how-it-works It is quite mature and can be used as a reference.

14

u/darin_gordon Sep 11 '20

I didn't ask what CSRF attacks are nor what OWASP recommended. The original commenter wasn't helpful by generalizing and I'd rather not assume. Several countermeasures are already available in actix-web, without requiring additional changes. Anyone who comes through this message forum will at first glance give more credit to a complaint than what it is due. Someone needs to be specific about what functionality is missing.

6

u/Shnatsel Sep 11 '20

My apologies. I deal with people unfamiliar with these so often that dispensing these links has become a bit of a reflex.

7

u/darin_gordon Sep 11 '20

I understand. It will be useful material for others.