Vulnerabilities repaired in which years

1.  CSRF attack and defense (very well written)

 But the   real fix is ​​to implant the token under the domain name cookie corresponding to the server, cross-domain access, the domain name is incorrect, and you can't get it. When you request your domain name, you can bring it into the parameters.

将csrf令牌写入Cookie，是因为：
服务器进行csrf防御校验的时候，是拿用户http请求体中的token参数值和cookie中的csrftoken值进行比对。
如果值一样了，操作才被允许执行。

2.