#16010: Support Origin header checking in the CSRF middleware
-----------------------------+--------------------------------------
Reporter: davidben | Owner: Tim Graham
Type: New feature | Status: assigned
Component: CSRF | Version: master
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 1
Easy pickings: 0 | UI/UX: 0
-----------------------------+--------------------------------------
Changes (by Tim Graham):
* cc: Adam Johnson (added)
Comment:
While trying to make origin checking reuse the lists of hosts that referer
checking uses, I noted that the values in the `CSRF_COOKIE_DOMAIN` and
`CSRF_TRUSTED_ORIGINS` settings don't include the URL scheme (which the
HTTP_ORIGIN header includes), and I'm not sure it's appropriate to discard
the `HTTP_ORIGIN` header's scheme in the comparison.
I'm not sure if we need new settings but I see that
[https://pypi.org/project/django-cors-headers/ djanog-cors-headers] has
some:
{{{
CORS_ALLOWED_ORIGINS = [
"https://example.com";,
"https://sub.example.com";,
"http://localhost:8080";,
"http://127.0.0.1:9000";
]
}}}
as well as:
{{{
CORS_ALLOWED_ORIGIN_REGEXES = [
r"^https://\w+\.example\.com$";,
]
}}}
and:
{{{
CORS_ALLOW_ALL_ORIGINS = (True or False)
}}}
Adam, maybe you have a suggestion here?
--
Ticket URL: <https://code.djangoproject.com/ticket/16010#comment:10>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/066.0ccabf6dcb1e45da714f4351f54344b2%40djangoproject.com.
