#28143: CSRF token fails when Debug is disabled and a custom view is used for
handler404
-----------------------------+--------------------------------------
Reporter: antigaprime | Owner: nobody
Type: Bug | Status: new
Component: CSRF | Version: 1.11
Severity: Normal | Resolution:
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-----------------------------+--------------------------------------
Comment (by antigaprime):
Replying to [comment:1 Tim Graham]:
> Can you explain why Django is at fault, or are you looking for help to
debug your application? In the latter case, you should
TicketClosingReasons/UseSupportChannels rather than this ticket tracker.
Well can you explain the behavior? Why would the CSRF fail for the admin
panel, considering that the token is rotated after login, not before, but
not for post requests in "my application"? The admin panel is not "my
application", it's a default component of Django. If the behavior is
erratic, it might as well be a bug, but if a Django developer comes on and
states that this is "expected behavior", then there should be an
explanation.
Help is always welcome, but I've already solved it. Adding the
`@requires_csrf_token` decorator solves it, but I still thought I'd create
the ticket, because there is no documentation regarding having to add this
decorator, and, I can't explain the behavior regarding switching from
using csrf in session and in cookies, and it randomly validating when
refreshing before logging in.
--
Ticket URL: <https://code.djangoproject.com/ticket/28143#comment:2>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/069.237b34e0131ab31bf302b5f34cf94b83%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
