title: Acunetix scan of Laravel login page
body: <p>I have an application written using Laravel 5.1 framework. Recently, one of my clients ran an Acunetix security scan on the application and found <a href="http://i.stack.imgur.com/oRXUJ.png" rel="nofollow">HTML form with no apparent CSRF protection</a> on my login page.</p>
  
  <p>However, the login form DOES have CSRF protection. The name of the element with the CSRF token is "_token". The scan result says "Discovered by: Crawler".</p>
  
  <p>So my questions are:</p>
  
  <ul>
  <li>Why is acunetix showing this result?</li>
  <li>Is "_token" not a recognized name for a CSRF token element? Should I add another hidden element into the form with the same value using a more recognizable name?</li>
  <li>What does it mean "Discovered by: Crawler"? Does this mean the scan only checks the form HTML and nothing else?</li>
  </ul>
  
  <p>Below is the snippet of the HTML form blade template:</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>@section('content')
          &lt;form id="loginForm" class="form-signin" role="form" method="POST" action="{{ url('/auth/login') }}"&gt;
              &lt;h2 class="form-signin-heading"&gt;&lt;img src="/images/J10_Logo_330x194.jpg" alt="{{ trans('content.image_alt.j10_logo') }}"&gt;&lt;/h2&gt;
              &lt;input type="hidden" name="_token" value=""&gt;
              &lt;label for="username" class=""&gt;{{ trans('auth.login.username') }}&lt;/label&gt;
              &lt;input type="username" class="form-control" name="username" value="{{ old('username') }}"&gt;
              &lt;label for="inputPassword" class=""&gt;{{ trans('auth.login.password') }}&lt;/label&gt;
              &lt;input type="password" class="form-control" name="password" autocomplete="off"&gt;
              &lt;div class="forgot-password"&gt;&lt;input type="checkbox" name="remember"&gt; {{ trans('auth.login.remember_me') }}&lt;/div&gt;
              &lt;div class="forgot-password"&gt;&lt;a href="#"&gt;{{ trans('auth.login.forgot_password') }}&lt;/a&gt;&lt;/div&gt;
              &lt;button type="submit" class="btn btn-lg btn-primary btn-block"&gt;{{ trans('auth.login.login') }}&lt;/button&gt;
  @if (count($errors) &gt; 0)
              &lt;p class="text-danger"&gt;
  @foreach($errors-&gt;all() as $error)
                  {{ $error }}&lt;br /&gt;
  @endforeach
              &lt;/p&gt;
  @endif
          &lt;/form&gt;
  @endsection</code></pre>
  </div>
  </div>
  </p>
  
  <p>You may notice that in the above snippet, the "_token" element value is blank. This is intentional since I am basically trying to "circumvent" acunetix's detection by only setting its value using javascript since everything I have tried so far does not seem to work.</p>