#28699: Document that REMOTE_USER must be logged in before making CSRF protected
requests.
-------------------------------+------------------------------------
Reporter: stephanm | Owner: Rodrigo
Type: Bug | Status: assigned
Component: Documentation | Version: 1.11
Severity: Normal | Resolution:
Keywords: remote user | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+------------------------------------
Comment (by Carlton Gibson):
> For this ticket I think documenting that remote user auth will require
two requests — one to login, on to submit further data passing CSRF — is
the best we can do.
Actually, I'm not exactly sure what to say here. Thinking about it,
exactly the same considerations apply to all login. You'd have to take
special measures to login a user and submit additional form data, whilst
also checking CSRF, in a single request, even if you were using session
based authentication with the model backend. (You'd write a view to do it,
manually calling `login()` yourself...)
I'm kind of inclined towards `wontfix` for that reason...
--
Ticket URL: <https://code.djangoproject.com/ticket/28699#comment:22>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/066.fbb4de0bc3b53b58b9b4e71e0515517f%40djangoproject.com.
