Opened 5 years ago

Closed 5 years ago

Last modified 5 years ago

#13849 closed (wontfix)

CsrfViewMiddleware is too strict on referer checking for secure requests

Reported by: pmclanahan Owned by: nobody
Component: Core (Other) Version: 1.2
Severity: Keywords: csrf
Cc: Triage Stage: Unreviewed
Has patch: no Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: UI/UX:


In a project we'd like to have forms exist on an insecure page, but submit to a secure URL, and be CSRF protected using the middleware. This is currently impossible due to the middleware checking for "https" in the referer header for secure requests. I feel this is too strict and a check for the same host would be sufficient if any referer check is required at all. The comment in the code above these lines even suggests that the check may be too strict.

The lines to which I'm referring are 134 - 137 in django/middleware/

I'll be happy to provide a patch if a course of action is decided upon in the discussion.

Change History (2)

comment:1 Changed 5 years ago by pmclanahan

  • Needs documentation unset
  • Needs tests unset
  • Patch needs improvement unset
  • Resolution set to wontfix
  • Status changed from new to closed

See mailinglist thread for explanation of reasons for wontfixing this.

comment:2 Changed 5 years ago by lukeplant

See [13405]

Note: See TracTickets for help on using tickets.
Back to Top