Hi
We have just conducted a security check on our site and found that both $LoginForm and the MemberLoginForm (at http://example.com/Security/login) do not use a SecurityID. According to the docs, form objects automatically contain a SecurityID to help prevent Cross-Site Request Forgery (https://docs.silverstripe.org/en/3.2/developer_guides/security/secure_coding/).
After a bit of hunting I found within the __construct function of LoginForm.php:

$this->disableSecurityToken();

Why is disableSecurityToken being called here? Is there a particular situation where this is needed? How is it possible to override it?
Any advice please? Thanks in advance.
Cheers Antony

I have no idea. You should open an issue on GitHub for this. Since it is an abstract class, maybe it's for custom LoginForms like OpenID?

How is it possible to override it?

You could overload the class via Injector. Something like:

Injector:
  MemberLoginForm:
    class: MyMemberLoginForm

class MyMemberLoginForm extends MemberLoginForm{
	public function __construct($controller, $name, $fields = null, $actions = null, $checkCurrentUser = true) {
		parent::__construct($controller, $name, $fields, $actions, $checkCurrentUser);

		$this->enableSecurityToken();
	}
}