#28699: Problem with CSRF in Django 1.11.6
---------------------------------+------------------------------------
Reporter: stephanm | Owner: nobody
Type: Bug | Status: new
Component: CSRF | Version: 1.11
Severity: Release blocker | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+------------------------------------
Comment (by stephanm):
Replying to [comment:7 Florian Apolloner]:
> ...
> before the CSRF middleware. The issue should be gone then, which will
probably mean that the fix will just be a documentation fix.
If the documentation fix is about to place AuthenticationMiddleware
before the CsrfViewMiddleware in the MIDDLEWARE setting then you
will have to do more than only changing the docs:
- You have to move AuthenticationMiddleware before the CsrfViewMiddleware
in the docs:\\
https://docs.djangoproject.com/en/1.11/topics/http/middleware
/#activating-middleware
- You will have to change: `django-admin startproject`
so that it generates the appropriate middleware ordering.
- You will have to change the middleware-ordering docs in:\\
https://docs.djangoproject.com/en/1.11/ref/middleware/#middleware-
ordering
- You will have to tell everybody that their settings.MIDDLEWARE has to
be modified, otherwise some functionality may be broken
- modify perhaps some other places in the docs i missed ...
Is it really only a documentation fix?
--
Ticket URL: <https://code.djangoproject.com/ticket/28699#comment:10>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/066.f4afa19e74734afb7857fced6da2fed6%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
