From b5fc192b99ce92a7ccad08cca7b59b1a4e7ca230 Mon Sep 17 00:00:00 2001
From: Markus Holtermann <info@markusholtermann.eu>
Date: Sat, 15 Oct 2016 20:32:19 +0200
Subject: [PATCH] Fixed #27352 -- Doc'd social media fingerprinting
consideration with login's redirect_authenticated_user.
---
docs/spelling_wordlist | 1 +
docs/topics/auth/default.txt | 9 +++++++++
2 files changed, 10 insertions(+)
diff --git a/docs/spelling_wordlist b/docs/spelling_wordlist
index d905196950..8218fe0219 100644
--- a/docs/spelling_wordlist
+++ b/docs/spelling_wordlist
@@ -253,6 +253,7 @@ fallback
fallbacks
faq
FastCGI
+favicon
fieldset
fieldsets
filename
diff --git a/docs/topics/auth/default.txt b/docs/topics/auth/default.txt
index 9d70cedf9d..cc4a0daf12 100644
--- a/docs/topics/auth/default.txt
+++ b/docs/topics/auth/default.txt
@@ -1006,6 +1006,15 @@ implementation details see :ref:`using-the-views`.
authenticated users accessing the login page will be redirected as if
they had just successfully logged in. Defaults to ``False``.
+ .. warning::
+
+ If you enable ``redirect_authenticated_user``, other websites will be
+ able to determine if their visitors are authenticated on your site by
+ requesting redirect URLs to image files on your website. To avoid
+ this "`social media fingerprinting
+ <https://robinlinus.github.io/socialmedia-leak/>`_" information
+ leakage, host all images and your favicon on a separate domain.
+
* ``success_url_allowed_hosts``: A :class:`set` of hosts, in addition to
:meth:`request.get_host() <django.http.HttpRequest.get_host>`, that are
safe for redirecting after login. Defaults to an empty :class:`set`.