# Adapting requests to include Anti-CSRF tokens

**URL:** <https://discourse.mitmproxy.org/t/adapting-requests-to-include-anti-csrf-tokens/974>\
**Category:** help\
**Created:** [April 10, 2018, 6:12am UTC](https://discourse.mitmproxy.org/t/adapting-requests-to-include-anti-csrf-tokens/974 "2018-04-10T06:12:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Anton](https://avatars.discourse-cdn.com/v4/letter/a/d9b06d/32.png) [@Anton](https://discourse.mitmproxy.org/u/Anton)\
**Post date:** [April 10, 2018, 6:12am UTC](https://discourse.mitmproxy.org/t/adapting-requests-to-include-anti-csrf-tokens/974/1 "2018-04-10T06:12:00Z")

</div>

Hi,

I was wondering what the best approach (using mitmproxy/mitmdump) would be for interacting with a site that uses Anti-CSRF tokens. Basically, I need to do the following:

1. GET a login page, parse the body looking for a token, and extract its value (using a regex or markers)
2. Submit the page again along with a username and password, this time with an updated header of the value from (1)
3. Repeat until login succeeds

I have done this previously using Burp macros + Intruder, however I am keen to use mitmproxy for future testing.

Any advice on how to approach this would be really appreciated.

Anton.

---

<div class="post-metadata">

**Author:** ![Anton](https://avatars.discourse-cdn.com/v4/letter/a/d9b06d/32.png) [@Anton](https://discourse.mitmproxy.org/u/Anton)\
**Post date:** [April 27, 2018, 12:04am UTC](https://discourse.mitmproxy.org/t/adapting-requests-to-include-anti-csrf-tokens/974/2 "2018-04-27T00:04:21Z")

</div>

@mhils any advice for the above?

---

<div class="post-metadata">

**Author:** ![mhils](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/mhils/32/7_2.png) [@mhils](https://discourse.mitmproxy.org/u/mhils)\
**Post date:** [May 16, 2018, 12:54pm UTC](https://discourse.mitmproxy.org/t/adapting-requests-to-include-anti-csrf-tokens/974/3 "2018-05-16T12:54:22Z")

</div>

Hi,

Not really - maybe @cortesi has some good suggestions. I would probably hack something together similar to the [stickycookie](https://github.com/mitmproxy/mitmproxy/blob/master/mitmproxy/addons/stickycookie.py) addon - it’s a tricky problem though as it will remain manual to some extent.