CsrfViewMiddleware is too strict on referer checking for secure requests

[Paul McLanahan]

In a project we'd like to have forms exist on an insecure page, but submit to a secure URL, and be CSRF protected using the middleware. This is currently impossible due to the middleware checking for "https" in the referer header for secure requests. I feel this is too strict and a check for the same host would be sufficient if any referer check is required at all. The comment in the code above these lines even suggests that the check may be too strict.

The lines to which I'm referring are 134 - 137 in django/middleware/csrf.py.

I'll be happy to provide a patch if a course of action is decided upon in the discussion.

[Paul McLanahan]

See mailinglist thread for explanation of reasons for wontfixing this.

​http://groups.google.com/group/django-developers/browse_thread/thread/22058adaf11e3ed6

[Luke Plant]

See [13405]