#32902: CsrfViewMiddleware.process_response()'s csrf_cookie_needs_reset and
csrf_cookie_set logic isn't right
--------------------------------+------------------------------------------
Reporter: Chris Jerdonek | Owner: Chris Jerdonek
Type: Bug | Status: assigned
Component: CSRF | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------+------------------------------------------
Comment (by Chris Jerdonek):
I believe the fix should look something like this:
{{{
diff --git a/django/middleware/csrf.py b/django/middleware/csrf.py
index c2a9470ab1..bf97e50146 100644
--- a/django/middleware/csrf.py
+++ b/django/middleware/csrf.py
@@ -437,15 +437,14 @@ class CsrfViewMiddleware(MiddlewareMixin):
return self._accept(request)
def process_response(self, request, response):
- if not getattr(request, 'csrf_cookie_needs_reset', False):
- if getattr(response, 'csrf_cookie_set', False):
- return response
-
- if not request.META.get("CSRF_COOKIE_USED", False):
+ # Prevent the cookie from being set twice.
+ if getattr(response, 'csrf_cookie_set', False):
return response
+ if (getattr(request, 'csrf_cookie_needs_reset', False) or
+ request.META.get("CSRF_COOKIE_USED")):
+ # Set the CSRF cookie even if it's already set so that the
+ # expiry timer gets renewed.
+ self._set_token(request, response)
+ response.csrf_cookie_set = True
- # Set the CSRF cookie even if it's already set, so we renew
- # the expiry timer.
- self._set_token(request, response)
- response.csrf_cookie_set = True
return response
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/32902#comment:1>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/067.839c1419e00876e5ab1230eead5490ac%40djangoproject.com.
