Hi Collin, Firefox doesn't include Origin header on same-origin POST/PUT/DELETE requests. I just tested it and this SO answer says the same <http://stackoverflow.com/a/15514049/145349>. But yes, checking both Origin and Referer headers would help giving support Origin When Cross-Origin.
I can create a ticket suggesting Django to check Origin header before checking Referer. Or do you want to create that Collin? Em sexta-feira, 4 de dezembro de 2015 14:54:36 UTC-3, Collin Anderson escreveu: > > Also, if we checked the origin header, would it allow us to at least > support the "Origin When Cross-Origin" policy in all browsers? (Use the > Origin header for Safari and the referrer for all of the other browsers?) > > > On Fri, Dec 4, 2015 at 10:38 AM, Tim Graham <timog...@gmail.com > <javascript:>> wrote: > >> Flávio, thanks -- since you seem to have a good understanding of the >> limitation, could you submit a documentation patch (or even just provide >> some draft text here)? >> >> On Friday, December 4, 2015 at 8:25:35 AM UTC-5, Flávio Junior wrote: >>> >>> Found a issue that already discusses this: >>> https://code.djangoproject.com/ticket/16870#comment:10 >>> >>> Em quinta-feira, 3 de dezembro de 2015 13:41:09 UTC-3, Flávio Junior >>> escreveu: >>>> >>>> Florian, then Django will have to keep this limitation: can't use a >>>> global no-referrer policy on HTTPS because of strict referrer check. >>>> Correct? Should I create an issue to keep this logged? >>>> >>>> Em quinta-feira, 3 de dezembro de 2015 13:19:38 UTC-3, Florian >>>> Apolloner escreveu: >>>>> >>>>> >>>>> >>>>> On Wednesday, December 2, 2015 at 7:37:30 PM UTC+1, Flávio Junior >>>>> wrote: >>>>>> >>>>>> If Django still needs >>>>>> <https://code.djangoproject.com/ticket/17563#comment:2> the strict >>>>>> referrer check, maybe a better error message should be implemented. >>>>>> >>>>> >>>>> I do not see any reason why it would not need it anymore. Django needs >>>>> to ensure that the request came from a "trusted origin", therefore we >>>>> still >>>>> need it. >>>>> >>>> -- >> You received this message because you are subscribed to the Google Groups >> "Django developers (Contributions to Django itself)" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to django-develop...@googlegroups.com <javascript:>. >> To post to this group, send email to django-d...@googlegroups.com >> <javascript:>. >> Visit this group at http://groups.google.com/group/django-developers. >> To view this discussion on the web visit >> https://groups.google.com/d/msgid/django-developers/c0ce17a5-3f0e-4218-a2c8-cecf7da07fb9%40googlegroups.com >> >> <https://groups.google.com/d/msgid/django-developers/c0ce17a5-3f0e-4218-a2c8-cecf7da07fb9%40googlegroups.com?utm_medium=email&utm_source=footer> >> . >> >> For more options, visit https://groups.google.com/d/optout. >> > > -- You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group. To unsubscribe from this group and stop receiving emails from it, send an email to django-developers+unsubscr...@googlegroups.com. To post to this group, send email to django-developers@googlegroups.com. Visit this group at http://groups.google.com/group/django-developers. To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/5f7b5a6e-0096-47ad-ad61-373a2d183c7c%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
