#28699: Document middleware ordering requirements following CSRF change in
Django
1.11.6
-------------------------------+------------------------------------
Reporter: stephanm | Owner: Rodrigo
Type: Bug | Status: assigned
Component: Documentation | Version: 1.11
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 1
Easy pickings: 0 | UI/UX: 0
-------------------------------+------------------------------------
Comment (by Carlton Gibson):
Right, some time later...
I think that prior to c4c128d67c7dc2830631c6859a204c9d259f1fb1 (for
#28488) there was actually a security issue in the way
`CsrfViewMiddleware` worked.
It would call `_get_token()` in `process_view()`, resetting the CSRF token
to the one submitted in the request, even though `rotate_token()` had
previously been
called during `login()` by the `RemoteUserMiddleware`.
This is equivalent to the `CsrfViewMiddleware` second case discussed
above. It allows the Login + CSRF check in the single request but is not
safe.
As such, that the behaviour changed slightly cannot be considered a
regression. (It should never have worked.)
**Possibly** `RemoteUserMiddleware` could be adjusted to defer rotating
the CSRF token (until say `process_response()`), but anything in that
ball-park is highly sensitive, and probably not worth the price of
admission.
For this ticket I think documenting that remote user auth will require two
requests — one to login, on to submit further data passing CSRF — is the
best we can do.
--
Ticket URL: <https://code.djangoproject.com/ticket/28699#comment:20>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/066.cb7640a5f539d7b1a8cb33cd1ba1830e%40djangoproject.com.
