Login sends token, but doesn't check it.

[rliebig]

On the form for login, a token is placed. However it is possible to delete this token and send the request without it. This is theoretically a CSRF-Vulnerability, but it would allow the attacker to log a user on a specific account in. There are 2 Solutions for this: Simply remove the token or check it.

[nidico]

Well, we should check it! The problem is that the login is performed by repoze.who.plugins.friendlyform, which is most likely the reason why this isn't implemented yet...

[rliebig]

I just noticed that the same problem occurs with the OpenID form under /openid/init, more specific, that there isn't a token at all. I'm not sure if this is a security problem.