#16010: Support Origin header checking in the CSRF middleware
-----------------------------+------------------------------------
Reporter: davidben | Owner: (none)
Type: New feature | Status: new
Component: CSRF | Version: master
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 1
Easy pickings: 0 | UI/UX: 0
-----------------------------+------------------------------------
Comment (by Matt Johnson):
More and more of my users are encountering problems with Django's CSRF
protection because it requires an HTTP referer. It's still a tiny number,
but it went from 0 in the last 10 years, to 3 in the last 6 months.
The referrer/origin checking seems unnecessary if CSRF_COOKIE_SECURE is
enabled.
In any case, is there a problem with essentially replacing this line:
https://github.com/django/django/blob/master/django/middleware/csrf.py#L240
with this:
{{{
referer = request.META.get('HTTP_ORIGIN',
request.META.get('HTTP_REFERER'))
}}}
and updating the error messages, tests, and documentation appropriately?
--
Ticket URL: <https://code.djangoproject.com/ticket/16010#comment:8>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/066.8e9941d6d3aff4e704b287b73d949cfb%40djangoproject.com.
