#27958: CSRF_COOKIE reset while requesting a broken relative URL over HTTPS
-------------------------------------+-------------------------------------
Reporter: cryptogun | Owner: nobody
Type: Bug | Status: closed
Component: CSRF | Version: 1.10
Severity: Normal | Resolution: invalid
Keywords: csrf reset https | Triage Stage:
403 | Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by cryptogun):
Replying to [comment:3 Tim Graham]:
I thought this ticket is closed and not commentable until I login now and
see the input area.
> If disabling CSRF_COOKIE_HTTPONLY fixes the issue
No that would not fix the issue. It's just a workaround.
`CSRF_COOKIE_HTTPONLY = False` I still can't make the POST.
In order to make POST I should:
- 1. Set `CSRF_COOKIE_HTTPONLY = False`
- 2. Remove all {{ csrf_token }}
- 3. Add at the end of the html body:
{{{
<script>
function getCookie(cname) {
var name = cname + "=";
var decodedCookie = decodeURIComponent(document.cookie);
var ca = decodedCookie.split(';');
for(var i = 0; i <ca.length; i++) {
var c = ca[i];
while (c.charAt(0) == ' ') {
c = c.substring(1);
}
if (c.indexOf(name) == 0) {
return c.substring(name.length, c.length);
}
}
return "";
}
$('form').submit(function(event) {event.preventDefault(); newform =
$(this).serialize();alert(newform + "&csrfmiddlewaretoken=" +
getCookie('csrftoken')); this.submit(); return false;})
</script>
}}}
> If you want to keep it enabled, then you need to submit AJAX
No. I have to disable it in order to submit AJAX successfully.
--
Ticket URL: <https://code.djangoproject.com/ticket/27958#comment:4>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/067.5641c89a3aa91accb3650704eda5bb72%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
