The csrf key must be somewhere in the webpage you are trying to access.
The csrf key is not generated by the user, instead, it is a unique secret value generated by the server-side application and transmitted to the client.
I try to establish a website-connection(web-login) via python. The login appears to need 3 keys (next to password and username of course). 2 of them are handed over via get and the third one is a csrf-key. The csrf-key is not contained in the html body of the current page nor is it in the link. (I checked this explicitly by using strg+f)
What other common ways are there to generate the csrf-key on the fly? (I explicitly checked by inspecting the post request that the csrf is included in the request, but I don't understand how it gets there)
csrf-key not as hidden input or as get: How can it be generated?