Opened 12 years ago

Closed 12 years ago

Last modified 12 years ago

#13849 closed (wontfix)

CsrfViewMiddleware is too strict on referer checking for secure requests

Reported by: Paul McLanahan Owned by: nobody
Component: Core (Other) Version: 1.2
Severity: Keywords: csrf
Cc: Triage Stage: Unreviewed
Has patch: no Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no


In a project we'd like to have forms exist on an insecure page, but submit to a secure URL, and be CSRF protected using the middleware. This is currently impossible due to the middleware checking for "https" in the referer header for secure requests. I feel this is too strict and a check for the same host would be sufficient if any referer check is required at all. The comment in the code above these lines even suggests that the check may be too strict.

The lines to which I'm referring are 134 - 137 in django/middleware/

I'll be happy to provide a patch if a course of action is decided upon in the discussion.

Change History (2)

comment:1 Changed 12 years ago by Paul McLanahan

Resolution: wontfix
Status: newclosed

See mailinglist thread for explanation of reasons for wontfixing this.

comment:2 Changed 12 years ago by Luke Plant

See [13405]

Note: See TracTickets for help on using tickets.
Back to Top