#24696: CSRF middleware wastefully calculates new tokens that are never used .
-------------------------------------+-------------------------------------
Reporter: electricjay | Owner: nobody
Type: | Status: closed
Cleanup/optimization |
Component: CSRF | Version: 1.8
Severity: Normal | Resolution: fixed
Keywords: CSRF performance | Triage Stage: Ready for
| checkin
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by Tim Graham <timograham@…>):
* status: new => closed
* resolution: => fixed
Comment:
In [changeset:"eef95ea96faef0b7dbbe0c8092202b74f68a899b" eef95ea]:
{{{
#!CommitTicketReference repository=""
revision="eef95ea96faef0b7dbbe0c8092202b74f68a899b"
Fixed #24696 -- Made CSRF_COOKIE computation lazy.
Only compute the CSRF_COOKIE when it is actually used. This is a
significant speedup for clients not using cookies.
Changed result of the “test_token_node_no_csrf_cookie” test: It gets
a valid CSRF token now which seems like the correct behavior.
Changed auth_tests.test_views.LoginTest.test_login_csrf_rotate to
use get_token() to trigger CSRF cookie inclusion instead of changing
request.META["CSRF_COOKIE_USED"] directly.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/24696#comment:5>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/069.b1f70c8f8c5ed4cb42dbdd2d5b16922c%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
