#33522: Unexpected behaviour when logging in
-------------------------------------+-------------------------------------
Reporter: Michael | Owner: nobody
Type: New feature | Status: closed
Component: contrib.auth | Version: 4.0
Severity: Normal | Resolution: invalid
Keywords: authentication log | Triage Stage:
in CSRF token | Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by Carlton Gibson):
* status: new => closed
* resolution: => invalid
Comment:
Others can comment, but this looks like exactly expected behaviour to me.
I'm not sure we can, or it's worth trying to work around.
I don't see that we're ever going to be able to update forms rendered
before a login with a fresh CSRF token. (Some JS maybe, but it's not clear
that's going to be 100% safe ever.)
> ... what if the CSRF middleware got the token from the cookie, instead
of from the form data?
This would totally defeat the point no? I get you to submit a form from my
evil site to yours; your browser sends the cookie; the only thing that
saves you is that I don't know the right token to add to the form data.
--
Ticket URL: <https://code.djangoproject.com/ticket/33522#comment:8>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/068.dbe60dd33cfffcfce7b0931c08cb4b15%40djangoproject.com.
