# CSRF on /login security alert from security scans

**URL:** <https://meta.discourse.org/t/csrf-on-login-security-alert-from-security-scans/104667>\
**Category:** Self-hosting\
**Created:** [December 19, 2018, 1:23pm UTC](https://meta.discourse.org/t/csrf-on-login-security-alert-from-security-scans/104667 "2018-12-19T13:23:42Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)\
**Post date:** [December 19, 2018, 1:45pm UTC](https://meta.discourse.org/t/csrf-on-login-security-alert-from-security-scans/104667/4 "2018-12-19T13:45:54Z")

</div>

> [@jlaura](#):
>
> I need to prove to the security team that the /login page is actually protected.

The full source code is available at [GitHub - discourse/discourse: A platform for community discussion. Free, open, simple. · GitHub](https://github.com/discourse/discourse)

From our [security document](https://github.com/discourse/discourse/blob/master/docs/SECURITY.md#csrf):

> [@](#):
>
> [CSRF](http://en.wikipedia.org/wiki/Cross-site_request_forgery) allows malicious sites to perform HTTP requests in the context of a forum user without their knowledge – mostly by getting users who already hold a valid forum login cookie to click a specific link in their web browser.
> 
> Discourse extends the built-in Rails CSRF protection in the following ways:
> 
> 1. By default any non GET requests ALWAYS require a valid CSRF token. If a CSRF token is missing Discourse will raise an exception.
> 2. API calls using the secret API bypass CSRF checks.
> 3. Certain pages are “cachable”, we do not render the CSRF token ( `<meta name='csrf-token' ...` ) on any cachable pages. Instead when users are about to perform the first non GET request they retrieve the token just in time via `GET session/csrf`

---

_[View the full topic](https://meta.discourse.org/t/csrf-on-login-security-alert-from-security-scans/104667)._