如何在我的gcp函数上实现csrf攻击实现

from flask import Flask, request, session, render_template_string
import os
import secrets

app = Flask(__name__)
app.secret_key = os.urandom(24)

@app.before_request
def csrf_protect():
    if request.method == "POST":
        token = session.pop('_csrf_token', None)
        if not token or token != request.form.get('_csrf_token'):
            abort(403)

def generate_csrf_token():
    if '_csrf_token' not in session:
        session['_csrf_token'] = secrets.token_hex(16)
    return session['_csrf_token']

app.jinja_env.globals['csrf_token'] = generate_csrf_token

@app.route('/form', methods=['GET', 'POST'])
def form():
    if request.method == 'POST':
        # 处理表单提交
        return 'Form submitted!'
    return render_template_string('''
        <form method="post">
            <input type="hidden" name="_csrf_token" value="{{ csrf_token() }}">
            <input type="text" name="data">
            <input type="submit" value="Submit">
        </form>
    ''')

if __name__ == '__main__':
    app.run()

fetch('/api/endpoint', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json',
        'X-CSRF-Token': csrfToken // 从页面或cookie中获取CSRF令牌
    },
    body: JSON.stringify({ data: 'example' })
})
.then(response => response.json())
.then(data => console.log(data))
.catch(error => console.error('Error:', error));

const express = require('express');
const app = express();

app.use(express.json());

app.post('/api/endpoint', (req, res) => {
    const origin = req.get('Origin');
    if (origin !== 'https://your-trusted-domain.com') {
        return res.status(403).send('Forbidden');
    }
    // 处理请求
    res.send('Request processed');
});

app.listen(3000, () => {
    console.log('Server running on port 3000');
});

Set-Cookie: sessionId=abc123; HttpOnly; Secure; SameSite=Strict

<form method="post">
    {% csrf_token %}
    <input type="text" name="data">
    <input type="submit" value="Submit">
</form>