Django/django
11
0
Fork 0
Code Pull Requests Projects Releases Activity

[2.2.x] Refs #28699 -- Clarified CSRF middleware ordering in relation to RemoteUserMiddleware.

Browse Source 
Backport of 94469504706b494877b6bb45a979bcb81c7fd7be from master
This commit is contained in:
Carlton Gibson 2019-10-02 13:11:03 +02:00 committed by Mariusz Felisiak
parent da31472abf
commit 09013aae13
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/ref/middleware.txt
View File

@ -458,6 +458,10 @@ Here are some hints about the ordering of various Django middleware classes:
Before any view middleware that assumes that CSRF attacks have been dealt
with.
Before :class:`~django.contrib.auth.middleware.RemoteUserMiddleware`, or any
other authentication middleware that may perform a login, and hence rotate
the CSRF token, before calling down the middleware chain.
After ``SessionMiddleware`` if you're using :setting:`CSRF_USE_SESSIONS`.
#. :class:`~django.contrib.auth.middleware.AuthenticationMiddleware`