#32817: Include in CsrfViewMiddleware's bad CSRF token message where the token
is
from
-------------------------------------+-------------------------------------
Reporter: Chris Jerdonek | Owner: nobody
Type: | Status: new
Cleanup/optimization |
Component: CSRF | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Description changed by Chris Jerdonek:
Old description:
> Currently, if `CsrfViewMiddleware` encounters a bad CSRF token, it will
> reject the request with a message like--
>
> * "CSRF token incorrect"
> * "CSRF token has incorrect length"
>
> I noticed that it would be relatively easy to include in these messages
> whether the token was obtained from `POST` data or a custom header, which
> would be useful for troubleshooting. The new messages could look e.g.
> like--
>
> * "CSRF token (from POST) incorrect"
> * "CSRF token (from 'X-CSRFToken' header) has incorrect length"
>
> The changes to `CsrfViewMiddlewareTestMixin` proposed in #32800 would
> make these cases easy to test.
New description:
Currently, if `CsrfViewMiddleware` encounters a bad CSRF token, it will
reject the request with a message like--
* "CSRF token incorrect"
* "CSRF token has incorrect length"
I noticed that it would be relatively easy to include in these messages
whether the token was obtained from `POST` data or a custom header, which
would be useful for troubleshooting. The messages are specified
[https://github.com/django/django/blob/213850b4b9641bdcb714172999725ec9aa9c9e84/django/middleware/csrf.py#L411-L417
here in the code]. The new messages could look e.g. like--
* "CSRF token (from POST) incorrect"
* "CSRF token (from 'X-CSRFToken' header) has incorrect length"
The changes to `CsrfViewMiddlewareTestMixin` proposed in #32800 would make
these cases easy to test.
--
--
Ticket URL: <https://code.djangoproject.com/ticket/32817#comment:1>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/067.56e17f3c75f476a136d8d4d2eb218640%40djangoproject.com.
