关于CSRF

As an example, let’s say that an email provider lets you delete your account by submitting a form. The form sends a POST request to an account_delete endpoint on their server and deletes the account that was logged-in when the form was submitted. We can create a form on our own site that sends a POST request to the same account_delete endpoint. Now, if we can get someone to click ‘submit’ on our form (or do it via JavaScript when they load the page) their logged-in account with the email provider will be deleted. Unless of course, the email provider knows not to assume that form submissions are coming from their own forms

举个例子，一个email服务商通过让你提交一个表格来删除你的账户。这个表格会提交一个post请求到服务器上来，当表单完成提交的时候会删除这个登录的账号。我们可以在我们的网站(和email服务商不同的网站)创建一个表格，发送一个post请求到同样的删除账户的网站。现在，如果有个人点击了我们提供的表单上的submit按钮，他们的账户就会被删除掉。除非，email服务商知道不要去假设那个表单的提交请求是来自于他们的网站的(也就是需要验证这个删除账户的请求，是否是来自于他们的网站的)。