#28699: Problem with CSRF in Django 1.11.6
---------------------------------+------------------------------------
Reporter: stephanm | Owner: nobody
Type: Bug | Status: new
Component: CSRF | Version: 1.11
Severity: Release blocker | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+------------------------------------
Comment (by stephanm):
Replying to [comment:7 Florian Apolloner]:
> ...
> before the CSRF middleware. The issue should be gone then, which will
probably mean that the fix will just be a documentation fix.
If the documentation fix is about to place AuthenticationMiddleware
before the CsrfViewMiddleware in the MIDDLEWARE setting then you
will have to do more than only changing the docs:
- You have to move AuthenticationMiddleware before the CsrfViewMiddleware
in the docs:\\
https://docs.djangoproject.com/en/1.11/topics/http/middleware
/#activating-middleware
- You will have to change: `django-admin startproject`
so that it generates the appropriate middleware ordering.
- You will have to change the middleware-ordering docs in:\\
https://docs.djangoproject.com/en/1.11/ref/middleware/#middleware-
ordering
- You will have to tell everybody that their settings.MIDDLEWARE has to
be modified, otherwise some functionality may be broken
- modify perhaps some other places in the docs i missed ...
Is it really only a documentation fix?
--
Ticket URL: <https://code.djangoproject.com/ticket/28699#comment:10>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/066.f4afa19e74734afb7857fced6da2fed6%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
