Django

# This is the single most common source of real CSRF findings in Django
# applications, and it is not obvious from reading the code.
#
# DRF's SessionAuthentication ENFORCES CSRF -- it explicitly calls the check.
# But DRF's other authentication classes DO NOT, because they are designed
# for credentials that are not ambient.
#
# The bug appears when a class that skips CSRF is combined with a credential
# that IS ambient.

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'rest_framework.authentication.SessionAuthentication',   # enforces CSRF
        'rest_framework.authentication.TokenAuthentication',     # does NOT
    ],
}

# DRF tries each class in order and stops at the first that authenticates.
# That is fine as written -- TokenAuthentication uses an Authorization
# header, which is not ambient, so skipping CSRF is correct for it.
#
# The danger is a CUSTOM authentication class that reads an ambient
# credential without enforcing CSRF:

class CookieTokenAuthentication(BaseAuthentication):
    def authenticate(self, request):
        # Reads a COOKIE -- ambient, sent automatically by the browser --
        # but inherits no CSRF enforcement. Every endpoint using this is
        # CSRF-able, and nothing in the code says so.
        token = request.COOKIES.get('auth_token')
        if not token:
            return None
        return (User.objects.get(auth_token=token), None)

    # The fix: implement enforce_csrf, as SessionAuthentication does.
    # def enforce_csrf(self, request):
    #     check = CSRFCheck(lambda r: None)
    #     check.process_request(request)
    #     reason = check.process_view(request, None, (), {})
    #     if reason:
    #         raise exceptions.PermissionDenied(f'CSRF Failed: {reason}')

# Also worth knowing: overriding SessionAuthentication to remove
# enforce_csrf() is a documented "fix" in several blog posts and Stack
# Overflow answers for making a SPA work. It disables CSRF protection
# entirely. Grep for `def enforce_csrf` returning None.

from django.views.decorators.csrf import csrf_exempt

# Almost always added to make something work during development -- a webhook,
# a mobile client sending the wrong header, an integration test -- and then
# never removed. Every one of these is a route with no CSRF protection.
@csrf_exempt
def webhook(request):
    # If this is a genuine third-party webhook, the exemption is legitimate --
    # but then it MUST authenticate by signature, not by session cookie.
    process(json.loads(request.body))
    return JsonResponse({'ok': True})

@csrf_exempt              # <- no justification at all
def change_email(request):
    request.user.email = request.POST['email']
    request.user.save()
    return JsonResponse({'ok': True})

# Audit with:
#   grep -rn 'csrf_exempt\|ensure_csrf_cookie\|requires_csrf_token' .
#
# Every hit needs a comment saying why. A webhook exempted from CSRF and
# authenticated by an HMAC signature is correct; anything authenticated by
# a session cookie is a finding.