Re: Rename salt to mask in CSRF

2020-02-19 Thread Ram Rachum
Cool, PR here: https://github.com/django/django/pull/12479 On Thu, Feb 20, 2020 at 1:59 AM Adam Johnson wrote: > I guess it's not a very big change so could be worth it to increase > readability. > > On Wed, 19 Feb 2020 at 16:12, Ram Rachum wrote: > >> In any case, if it's decided that it's a

Re: Rename salt to mask in CSRF

2020-02-19 Thread Adam Johnson
I guess it's not a very big change so could be worth it to increase readability. On Wed, 19 Feb 2020 at 16:12, Ram Rachum wrote: > In any case, if it's decided that it's a worthwhile change, I'll be happy > to make the patch. > > On Wed, Feb 19, 2020 at 10:31 AM Adam Johnson wrote: > >> The

Re: Rename salt to mask in CSRF

2020-02-19 Thread charettes
I think it's a non-invasive worthwhile change and that a PR for it would be well received. Le mercredi 19 février 2020 11:13:15 UTC-5, Ram Rachum a écrit : > > In any case, if it's decided that it's a worthwhile change, I'll be happy > to make the patch. > > On Wed, Feb 19, 2020 at 10:31 AM

Re: Rename salt to mask in CSRF

2020-02-19 Thread Ram Rachum
In any case, if it's decided that it's a worthwhile change, I'll be happy to make the patch. On Wed, Feb 19, 2020 at 10:31 AM Adam Johnson wrote: > The wikipedia page says: > > In cryptography, a salt is random data that is used as an additional input >> to a one-way function that hashes data,

Re: Rename salt to mask in CSRF

2020-02-19 Thread Adam Johnson
The wikipedia page says: In cryptography, a salt is random data that is used as an additional input > to a one-way function that hashes data, a password or passphrase. Salts are > used to safeguard passwords in storage. Ram is right - this variable is not a salt in that definition. We aren't

Re: Rename salt to mask in CSRF

2020-02-18 Thread Matemática A3K
On Tue, Feb 18, 2020 at 3:31 AM Ram Rachum wrote: > Hi guys, > > Recently I was working with Django's CSRF protection, customizing it to my > needs, and discussing with co-workers exactly how it works and how it has > protection against the BREACH attack being used to retrieve the CSRF key. >