Re: [Django] #26628: Log CSRF failures to django.security by default.

[Django]

#26628: Log CSRF failures to django.security by default.
--+
 Reporter:  jacobian  |Owner:  Hwesta
 Type:  Cleanup/optimization  |   Status:  assigned
Component:  Documentation |  Version:  1.9
 Severity:  Normal|   Resolution:
 Keywords:  csrf security | Triage Stage:  Accepted
Has patch:  0 |  Needs documentation:  1
  Needs tests:  0 |  Patch needs improvement:  0
Easy pickings:  1 |UI/UX:  0
--+

Comment (by Tim Graham ):

 In [changeset:"697ed75de5197a2175247464e1eee14fcf38562f" 697ed75]:
 {{{
 #!CommitTicketReference repository=""
 revision="697ed75de5197a2175247464e1eee14fcf38562f"
 [1.10.x] Refs #26628 -- Documented CSRF failure logging.

 Backport of ff9198ee0f1de24a5b2861d28849344e7a5714c4 from master
 }}}

--
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/066.5610682486b0c5eb931505c11ae97881%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #26628: Log CSRF failures to django.security by default.

[Django]

#26628: Log CSRF failures to django.security by default.
--+
 Reporter:  jacobian  |Owner:  Hwesta
 Type:  Cleanup/optimization  |   Status:  assigned
Component:  Documentation |  Version:  1.9
 Severity:  Normal|   Resolution:
 Keywords:  csrf security | Triage Stage:  Accepted
Has patch:  0 |  Needs documentation:  1
  Needs tests:  0 |  Patch needs improvement:  0
Easy pickings:  1 |UI/UX:  0
--+

Comment (by Tim Graham ):

 In [changeset:"cbc8ef6127a92cc59dfb28461e865242e5e39329" cbc8ef61]:
 {{{
 #!CommitTicketReference repository=""
 revision="cbc8ef6127a92cc59dfb28461e865242e5e39329"
 [1.9.x] Refs #26628 -- Documented CSRF failure logging.

 Backport of ff9198ee0f1de24a5b2861d28849344e7a5714c4 from master
 }}}

--
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/066.d8defe887570ae2312cc12cb82e992c4%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #26628: Log CSRF failures to django.security by default.

[Django]

#26628: Log CSRF failures to django.security by default.
--+
 Reporter:  jacobian  |Owner:  Hwesta
 Type:  Cleanup/optimization  |   Status:  assigned
Component:  Documentation |  Version:  1.9
 Severity:  Normal|   Resolution:
 Keywords:  csrf security | Triage Stage:  Accepted
Has patch:  0 |  Needs documentation:  1
  Needs tests:  0 |  Patch needs improvement:  0
Easy pickings:  1 |UI/UX:  0
--+

Comment (by Tim Graham ):

 In [changeset:"ff9198ee0f1de24a5b2861d28849344e7a5714c4" ff9198e]:
 {{{
 #!CommitTicketReference repository=""
 revision="ff9198ee0f1de24a5b2861d28849344e7a5714c4"
 Refs #26628 -- Documented CSRF failure logging.
 }}}

--
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/066.b5a6805f46e59c0ff47b3fe35c172e13%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #26628: Log CSRF failures to django.security by default.

[Django]

#26628: Log CSRF failures to django.security by default.
--+
 Reporter:  jacobian  |Owner:  Hwesta
 Type:  Cleanup/optimization  |   Status:  assigned
Component:  Documentation |  Version:  1.9
 Severity:  Normal|   Resolution:
 Keywords:  csrf security | Triage Stage:  Accepted
Has patch:  0 |  Needs documentation:  1
  Needs tests:  0 |  Patch needs improvement:  0
Easy pickings:  1 |UI/UX:  0
--+

Comment (by carljm):

 I guess I'm not too concerned about back-compat, because it seems it would
 only be an issue in a case where someone has configured logging to watch
 `django.request` but ignore `django.security`, which seems like a pretty
 strange choice. But I also don't feel strongly. I'd be inclined to merge
 the doc fix that Hwesta has already submitted
 (https://github.com/django/django/pull/6694/files) but as a `Refs`, and
 leave this open for further discussion of the actual logger change.

--
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/066.382f546a3936c938edcec7c13c68b93c%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #26628: Log CSRF failures to django.security by default.

[Django]

#26628: Log CSRF failures to django.security by default.
--+
 Reporter:  jacobian  |Owner:  Hwesta
 Type:  Cleanup/optimization  |   Status:  assigned
Component:  Documentation |  Version:  1.9
 Severity:  Normal|   Resolution:
 Keywords:  csrf security | Triage Stage:  Accepted
Has patch:  0 |  Needs documentation:  1
  Needs tests:  0 |  Patch needs improvement:  0
Easy pickings:  1 |UI/UX:  0
--+

Comment (by timgraham):

 Are you concerned at all about backwards-compatibility in the case of some
 custom logging?

--
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/066.523732e14076b66fd2985be08f7750a6%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #26628: Log CSRF failures to django.security by default. (was: Document that CSRF violations are logged to the django.request logger)

[Django]

#26628: Log CSRF failures to django.security by default.
--+
 Reporter:  jacobian  |Owner:  Hwesta
 Type:  Cleanup/optimization  |   Status:  assigned
Component:  Documentation |  Version:  1.9
 Severity:  Normal|   Resolution:
 Keywords:  csrf security | Triage Stage:  Accepted
Has patch:  0 |  Needs documentation:  1
  Needs tests:  0 |  Patch needs improvement:  0
Easy pickings:  1 |UI/UX:  0
--+

Comment (by carljm):

 Sergio Campos (seocam) and I were just discussing this same issue at the
 PyCon sprint (in the context of looking at the broader context in #26688).
 I'm inclined to agree with mallyvai that this isn't just a doc bug -- we
 should be logging CSRF failures to django.security by default. Updating
 the ticket title accordingly -- please let me know if you don't agree, or
 think this should be discussed on the mailing list.

--
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/066.7ad6743ddd81d19c41150ba971d8a493%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.