#27958: CSRF_COOKIE reset while requesting a broken relative URL over HTTPS
-------------------------------------+-------------------------------------
Reporter: cryptogun | Owner: nobody
Type: Bug | Status: new
Component: CSRF | Version: 1.10
Severity: Normal | Resolution:
Keywords: csrf reset https | Triage Stage:
403 | Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by cryptogun):
Replying to [comment:1 Tim Graham]:
> I'm not sure there's a bug in Django here. Why isn't the CSRF token sent
with the request for the broken relative link?
New CSRF token did sent and stored in cookie (for the broken relative
link).
But `manage.py check --deploy` suggest me to set this to true:
`CSRF_COOKIE_HTTPONLY = True`
> If True, client-side JavaScript is not able to access the CSRF cookie.
This can help prevent malicious JavaScript from bypassing CSRF protection.
But `{{ csrf_token }}` are static in pages that're already opened
previously.
{{{
if not _compare_salted_tokens(request_csrf_token, csrf_token):
return self._reject(request, REASON_BAD_TOKEN)
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/27958#comment:2>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/067.09db053615c851a2129565828298c721%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
