#32562: Broken Authentication (Insecure CSRF and Session ID)
---------------------------------------------+------------------------
Reporter: cpulidomagentrack | Owner: nobody
Type: Bug | Status: new
Component: CSRF | Version: 3.1
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
---------------------------------------------+------------------------
We have currently carried out security tests on our system developed with
Django, our security specialists report a vulnerability to us when a CSRF
(Broken Authentication) token is obtained.
(Insecure CSRF and Session ID)), since if this token is obtained it is
possible to reuse it several times allowing brute force attacks. Is it
possible to modify the validity of this token or disable it when it is
consumed in a post/put request and generate a new token within the session
or limited the time valid from the inicial token CSRF ?
--
Ticket URL: <https://code.djangoproject.com/ticket/32562>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/060.8c3b5a18cc6fba35a66b5c52b3c12394%40djangoproject.com.
