#26628: CSRF violations should be logged
---------------------------------------+-------------------------------
Reporter: jacobian | Owner: nobody
Type: New feature | Status: new
Component: CSRF | Version: 1.9
Severity: Normal | Keywords: csrf security
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
---------------------------------------+-------------------------------
It's currently possible to log CSRF exceptions with the 403 handler. But a
more sensible default would be to log them by default. This would be an
easy simple step that would make Django play more nicely with a SIEM
[One of a series of bugs from a discussion I had with @mallyvai about
improving the security of Django's admin - see
https://gist.github.com/mallyvai/bcb0bb827d6d53212879dff23cf15d03 for the
full list.]
--
Ticket URL: <https://code.djangoproject.com/ticket/26628>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/051.86a22b9857a465766f676ea19e22af08%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
