Django/django
11
0
Fork 0
Code Pull Requests Projects Releases Activity

[1.9.x] Fixed #26201 -- Documented the consequences of rotating the CSRF token on login.

Browse Source 
Backport of 369fa471f46cd517edf5fc82e4ef6138de3cff6 from master
This commit is contained in:
Vaclav Ehrlich 2016-04-03 11:35:24 +02:00 committed by Tim Graham
parent 9dc22b4ff6
commit 147f9a0d2a
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
docs/ref/csrf.txt
View File

@ -227,6 +227,9 @@ The CSRF protection is based on the following things:
every response that has called ``django.middleware.csrf.get_token()`` every response that has called ``django.middleware.csrf.get_token()``
(the function used internally to retrieve the CSRF token). (the function used internally to retrieve the CSRF token).
For security reasons, the value of the CSRF cookie is changed each time a
user logs in.
2. A hidden form field with the name 'csrfmiddlewaretoken' present in all 2. A hidden form field with the name 'csrfmiddlewaretoken' present in all
outgoing POST forms. The value of this field is the value of the CSRF outgoing POST forms. The value of this field is the value of the CSRF
cookie. cookie.
@ -505,3 +508,11 @@ because it invalidates all previous forms. Most users would be very unhappy to
find that opening a new tab on your site has invalidated the form they had find that opening a new tab on your site has invalidated the form they had
just spent time filling out in another tab or that a form they accessed via just spent time filling out in another tab or that a form they accessed via
the back button could not be filled out. the back button could not be filled out.
Why might a user encounter a CSRF validation failure after logging in?
----------------------------------------------------------------------
For security reasons, CSRF tokens are rotated each time a user logs in. Any
page with a form generated before a login will have an old, invalid CSRF token
and need to be reloaded. This might happen if a user uses the back button after
a login or if they log in in a different browser tab.