mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-04-25 17:54:37 +00:00
Code Issues 32 Releases Wiki Activity

Fixed #26201 -- Documented the consequences of rotating the CSRF token on login.

Browse Source
This commit is contained in:
Vaclav Ehrlich 2016-04-03 11:35:24 +02:00 committed by Tim Graham
parent 02ae5fd31a
commit 369fa471f4
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
django/views/csrf.py
View File

@ -78,6 +78,9 @@ CSRF_FAILURE_TEMPLATE = """
<code>csrf_protect</code> on any views that use the <code>csrf_token</code> <code>csrf_protect</code> on any views that use the <code>csrf_token</code>
template tag, as well as those that accept the POST data.</li> template tag, as well as those that accept the POST data.</li>
<li>The form has a valid CSRF token. After logging in in another browser
tab or hitting the back button after a login, you may need to reload the
page with the form, because the token is rotated after a login.</li>
</ul> </ul>
<p>You're seeing the help section of this page because you have <code>DEBUG = <p>You're seeing the help section of this page because you have <code>DEBUG =

11
docs/ref/csrf.txt
View File

@ -227,6 +227,9 @@ The CSRF protection is based on the following things:
every response that has called ``django.middleware.csrf.get_token()`` every response that has called ``django.middleware.csrf.get_token()``
(the function used internally to retrieve the CSRF token). (the function used internally to retrieve the CSRF token).
For security reasons, the value of the CSRF cookie is changed each time a
user logs in.
2. A hidden form field with the name 'csrfmiddlewaretoken' present in all 2. A hidden form field with the name 'csrfmiddlewaretoken' present in all
outgoing POST forms. The value of this field is the value of the CSRF outgoing POST forms. The value of this field is the value of the CSRF
cookie. cookie.
@ -505,3 +508,11 @@ because it invalidates all previous forms. Most users would be very unhappy to
find that opening a new tab on your site has invalidated the form they had find that opening a new tab on your site has invalidated the form they had
just spent time filling out in another tab or that a form they accessed via just spent time filling out in another tab or that a form they accessed via
the back button could not be filled out. the back button could not be filled out.
Why might a user encounter a CSRF validation failure after logging in?
----------------------------------------------------------------------
For security reasons, CSRF tokens are rotated each time a user logs in. Any
page with a form generated before a login will have an old, invalid CSRF token
and need to be reloaded. This might happen if a user uses the back button after
a login or if they log in in a different browser tab.