Django

Code

Show
Ignore:
Timestamp:
08/16/07 09:09:41 (1 year ago)
Author:
lukeplant
Message:

Added a reference for the claim in CSRF docs that GET requests
should be side-effect free.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • django/trunk/docs/csrf.txt

    r4224 r5902  
    4242can be used to POST data back. 
    4343 
    44 It deliberately only targets HTTP POST requests (and the corresponding 
    45 POST forms). GET requests ought never to have side effects (if you are 
    46 using HTTP GET and POST correctly), and so a CSRF attack with a GET 
    47 request will always be harmless. 
     44It deliberately only targets HTTP POST requests (and the corresponding POST 
     45forms). GET requests ought never to have any potentially dangerous side 
     46effects (see `9.1.1 Safe Methods, HTTP 1.1, RFC 2616`_), and so a 
     47CSRF attack with a GET request ought to be harmless. 
    4848 
    4949POST requests that are not accompanied by a session cookie are not protected, 
    …… 
    5454pages that are served as 'text/html' or 'application/xml+xhtml' 
    5555are modified. 
     56 
     57.. _9.1.1 Safe Methods, HTTP 1.1, RFC 2616: http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html 
    5658 
    5759Limitations