#31845: CSRF check fails when browsing with FQDN with trailing dot
------------------------+--------------------------------------
Reporter: ippei | Owner: nobody
Type: Bug | Status: closed
Component: CSRF | Version: 2.2
Severity: Normal | Resolution: wontfix
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
------------------------+--------------------------------------
Changes (by Carlton Gibson):
* cc: Florian Apolloner (added)
* status: new => closed
* resolution: => wontfix
Comment:
Hi. Thanks for the report. Interesting one.
I'm going to close as `wontfix` since I think this is expected behaviour.
`request.get_host()` doesn't strip anything — it ultimately just uses the
information given in the WSGI environment, and `is_same_domain()`
shouldn't return `True` when the trailing slash is added (it's as you say,
fully-qualified at that point...)
I'll cc Florian, who knows more about these things and may be able to
comment more authoritatively.
> ...when user is browsing with FQDN with trailing dot.
I'm struggling to see how this comes up. Browsers seem quite keen to strip
that trailing `.` when trying to reproduce this?
--
Ticket URL: <https://code.djangoproject.com/ticket/31845#comment:3>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/067.be8cc3d58be24f520f3d0ebe2a06c2ef%40djangoproject.com.
