mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-31 09:41:08 +00:00
Code Issues 32 Releases Wiki Activity

[1.10.x] Fixed #27352 -- Doc'd social media fingerprinting consideration with login's redirect_authenticated_user.

Browse Source 
Backport of b5fc192b99 from master
This commit is contained in:
Markus Holtermann
2016-10-15 20:32:19 +02:00
committed by Tim Graham
parent 64e4adbfef
commit d3ca290778
2 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
docs/spelling_wordlist
View File

@@ -253,6 +253,7 @@ fallback
fallbacks
faq
FastCGI
favicon
fieldset
fieldsets
filename

9
docs/topics/auth/default.txt
View File

@@ -999,6 +999,15 @@ implementation details see :ref:`using-the-views`.
authenticated users accessing the login page will be redirected as if
they had just successfully logged in. Defaults to ``False``.
.. warning::
If you enable ``redirect_authenticated_user``, other websites will be
able to determine if their visitors are authenticated on your site by
requesting redirect URLs to image files on your website. To avoid
this "`social media fingerprinting
<https://robinlinus.github.io/socialmedia-leak/>`_" information
leakage, host all images and your favicon on a separate domain.
.. deprecated:: 1.9
The ``current_app`` parameter is deprecated and will be removed in