I try to establish a website-connection(web-login) via python. The login appears to need 3 keys (next to password and username of course). 2 of them are handed over via get and the third one is a csrf-key. The csrf-key is not contained in the html body of the current page nor is it in the link. (I checked this explicitly by using strg+f)
What other common ways are there to generate the csrf-key on the fly? (I explicitly checked by inspecting the post request that the csrf is included in the request, but I don't understand how it gets there)
The csrf key must be somewhere in the webpage you are trying to access.
The csrf key is not generated by the user, instead, it is a unique secret value generated by the server-side application and transmitted to the client.
csrf-key not as hidden input or as get: How can it be generated?