#33522: Unexpected behaviour when logging in
-------------------------------------+-------------------------------------
Reporter: Michael | Owner: nobody
Type: New feature | Status: closed
Component: contrib.auth | Version: 4.0
Severity: Normal | Resolution: invalid
Keywords: authentication log | Triage Stage:
in CSRF token | Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Florian Apolloner):
> Thinking about this some more, what if the CSRF middleware got the token
from the cookie, instead of from the form data? This would solve the CSRF
errors that pop up every now and then.
Then it would compare the cookie against the cookie providing no security
:) It has to compare the cookie (something the attacker cannot control) to
the POST data (or header as fallback).
--
Ticket URL: <https://code.djangoproject.com/ticket/33522#comment:9>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/068.70277cef85d0b6e7b9b5804efeae2226%40djangoproject.com.
