#30514: Occasional CSRF cookie not set Django 2.1
------------------------------+--------------------------------------
Reporter: Yusuf Musleh | Owner: nobody
Type: Bug | Status: closed
Component: CSRF | Version: 2.1
Severity: Normal | Resolution: needsinfo
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
------------------------------+--------------------------------------
Changes (by Carlton Gibson):
* status: new => closed
* resolution: => needsinfo
Comment:
Hi Yusuf,
Thanks for the report. Very well explained, and interesting.
To be honest, there's not much I can say immediately. There's two possible
scenarios:
1. There's a correct HTTP request, which Django is mishandling.
2. Django's behaving, but the HTTP request is missing something.
If you could put a test case together showing 1 then we'd having something
we could directly address.
Re 2, the only thing that immediately comes to mind is that we've seen
Safari behaving ''strangely'' due to it's newer "Intelligent Tracking
Protection". More or less, when using (multiple?) internal redirects,
Safari will simply not send the cookies for the request, which would
explain how your session lookup would be failing.
There's django-developers thread on this topic here:
https://groups.google.com/d/topic/django-developers/RyDdt1TcH0c/discussion
Since you have the Sentry data available, can you see if perhaps Safari is
the common theme here?
If it's not, what else do the requests have in common?
Maybe someone on [https://groups.google.com/forum/#!forum/django-users
django-users] will have seen similar and can help to pin it down?
As it stands I'm going to close this as `needsinfo`. I'm really happy to
re-open if can show Django is somehow at fault.
(If it is Safari that's at issue, it' worth continuing the django-
developers discussion, because we should/could at least try to codify
exactly what's happening and how to handle it...)
--
Ticket URL: <https://code.djangoproject.com/ticket/30514#comment:1>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/070.72a77e8db113f15beeb76c93d9629271%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
