#27958: CSRF_COOKIE reset while requesting a broken relative URL over HTTPS
-------------------------------------+-------------------------------------
Reporter: cryptogun | Owner: nobody
Type: Bug | Status: closed
Component: CSRF | Version: 1.10
Severity: Normal | Resolution: invalid
Keywords: csrf reset https | Triage Stage:
403 | Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by cryptogun):
My fault. I forgot to add a `requires_csrf_token` decorator to my custom
404 handler. Sorry for the bothering.
Quote from Django code:
{{{
# This can be called when CsrfViewMiddleware.process_view has not run,
# therefore need @requires_csrf_token in case the template needs
# {% csrf_token %}.
@requires_csrf_token
def page_not_found(
}}}
My custom 404 handler used to be:
{{{
def handler404(request):
html404 = {'general': 'homepage/404.html',
'app1': 'homepage/app1_not_found.html'}
if request.path.startswith('/app1/'):
response = render(request, html404['app1'],
# context=RequestContext(request)
)
else:
response = render(request, html404['general'],
# context=RequestContext(request)
)
response.status_code = 404
return response
}}}
Solution 1, use built-in `page_not_found`:
{{{
def handler404(request, exception):
if request.path.startswith('/app1/'):
template_name='homepage/app1_not_found.html'
else:
template_name='homepage/404.html'
return page_not_found(request, exception, template_name=template_name)
}}}
Solution 2, uncommit `RequestContext(request)` to get csrftoken from
request. So Django won't generate a new csrftoken.
Either way solves the problem.
I learned that code from [http://stackoverflow.com/a/24725091 here] and
[http://stackoverflow.com/a/35110595 here], but omitted the crucial parts.
--
Ticket URL: <https://code.djangoproject.com/ticket/27958#comment:6>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/067.df5860eb3634ff395f2c90febaf1abf6%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
