#31089: May be CSRF middleware logical error
--------------------------------------+----------------------------
Reporter: sinyawskiy | Owner: nobody
Type: Bug | Status: new
Component: CSRF | Version: 2.2
Severity: Normal | Keywords: CSRF Token
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 1
UI/UX: 0 |
--------------------------------------+----------------------------
In file middleware/csrf.py in class CsrfViewMiddleware in process view:
DJANGO (2.2.8 and other)
We check the request for a token.
Check that method is not in (GET, HEAD, OPTIONS, TRACE), then
(In line 284) check CSRF cookie, than if not token -> reject. Check
request finished in this line always.
But in line 293. We check POST data. Need to exists both cookie and data
value csrfmiddlewaretoken ??? Why?
And in line 304. If not method POST we check PUT and DELETE, get token
value from request header. Need to exists both cookie and header value
X-CSRFToken? Why?
In my opinion. CSRF need check in COOKIE after PUT POST DELETE methods,
and reject if not set token in all methods and in COOKIE to.
Thank you very much.
--
Ticket URL: <https://code.djangoproject.com/ticket/31089>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/053.cdf74452891c98754f82e0d21cfef5f7%40djangoproject.com.
