Create example.py

[try-panwiac]

No description provided.

[prisma-cloud-devsecops]

Prisma Cloud has found errors in this PR ⬇️

[prisma-cloud-devsecops]

  CSRF protections disabled
    File: example.py | Checkov ID: CKV3_SAST_56

How To Fix

from flask_wtf.csrf import CSRFProtect

app = flask.Flask(name)
csrf = CSRFProtect(app)

Description

CWE: CWE-352: Cross-Site Request Forgery (CSRF)
OWASP: A01:2021-Broken Access Control

Cross-Site Request Forgery (CSRF) is an attack that forces a victim to execute unwanted actions on a web application they are authenticated with. By disabling CSRF protections, applications expose themselves to a serious security risk. This policy has identified instances where CSRF protections are disabled or not correctly implemented.

When CSRF protections are disabled, it can lead to:

1. Unauthorized actions performed on behalf of an authenticated user.
2. Data breaches.
3. Account hijacking.
4. Exploitation of the trust a user has with a specific site.

In the analyzed codebase, instances were detected where the CSRF protections were explicitly turned off. Such configurations increase the application's vulnerability to CSRF attacks.

For example, avoiding practices like:

python
# Disabling CSRF protection in Flask-WTF
class MyForm(flask_wtf.FlaskForm):
    class Meta:
        csrf = False