pyramid

Beyond what other people mentioned, some sites and frameworks also rely on the Referer header as part of CSRF protection. It's not truly necessary to check, but it's an OWASP recommendation so it seems like a decent number of places implemented it by default. I recently got the Pyramid Python framework to make it possible to disable Referer-checking for the built-in CSRF protection, but they're still going to keep requiring the header by default: https://github.com/Pylons/pyramid/issues/3508 More discussion about it in these pull requests too: https://github.com/Pylons/pyramid/pull/3512 https://github.com/Pylons/pyramid/pull/3518 The new version with it being optional hasn't been released yet, so as of right now almost everyone using Pyramid will still require users to send a Referer header to get past any CSRF checks.

For Python, check out the Pyramid web framework: https://github.com/Pylons/pyramid

A large Python project that I haven't seen mentioned by others but that I find to be particularly well written and designed is the Pyramid web framework. * https://github.com/Pylons/pyramid/