tornado

tornado.js

def xsrf_form_html(self) -> str:
    """An HTML ``<input/>`` element to be included with all POST forms.
    It defines the ``_xsrf`` input value, which we check on all POST
    requests to prevent cross-site request forgery. If you have set
    the ``xsrf_cookies`` application setting, you must include this
    HTML within all of your HTML forms.
    In a template, this method should be called with ``{% module
    xsrf_form_html() %}``
    See `check_xsrf_cookie()` above for more information.
    """
    return (
        '<input type="hidden" name="_xsrf" value="'
        + escape.xhtml_escape(self.xsrf_token)
        + '"/>'
    )