伪造跨站点请求伪造(CSRF)令牌

from flask import Flask, session, request, redirect, url_for
import secrets

app = Flask(__name__)
app.secret_key = secrets.token_hex(16)

@app.route('/form', methods=['GET', 'POST'])
def form():
    if request.method == 'POST':
        token = session.pop('_csrf_token', None)
        if not token or token != request.form.get('_csrf_token'):
            return "CSRF token missing or incorrect", 400
        # 处理表单数据
        return "Form submitted successfully"
    token = secrets.token_hex(16)
    session['_csrf_token'] = token
    return f'''
        <form method="post">
            <input type="hidden" name="_csrf_token" value="{token}">
            <!-- 其他表单字段 -->
            <button type="submit">Submit</button>
        </form>
    '''

if __name__ == '__main__':
    app.run()