#25030: The /admin/login/ should observe external authentication even when it
appears in POST
------------------------------+------------------------------------
Reporter: adelton | Owner: nobody
Type: New feature | Status: new
Component: contrib.auth | Version: master
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 1
Easy pickings: 0 | UI/UX: 0
------------------------------+------------------------------------
Comment (by carljm):
This use case seems highly specialized to me; we should make it possible,
but it doesn't need to work out of the box and certainly doesn't provide
any justification for wide-ranging changes in the design of contrib.auth.
Allowing login via GET request seems like a recipe for login CSRF attacks,
so I don't think the admin should generally be modified to allow that.
Can you just configure Apache to redirect after it intercepts a login?
That seems like the most straightforward approach here.
--
Ticket URL: <https://code.djangoproject.com/ticket/25030#comment:6>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/065.79e73901e99c14299d41b84b4126f23a%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
