Code

Opened 3 years ago

Closed 3 years ago

Last modified 17 months ago

#16870 closed Bug (wontfix)

CSRF too strict when no referer is present

Reported by: rtux Owned by: nobody
Component: contrib.csrf Version: 1.5
Severity: Normal Keywords:
Cc: fritsch+djangoproject.com@… Triage Stage: Unreviewed
Has patch: no Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description

For privacy reasons, users may decide to stop their browser from sending referer headers, which is fine with probably 99.9% of the webpages. I recently had troubles logging into launchpad, which uses django’s csrf-protection and it turned out to be due to the missing referer header from my browser.
So just the fact, that the header is missing should not imply, that the request is invalid.

This concerns mainly the function django.middleware.csrf.CsrfViewMiddleware.process_view

Attachments (0)

Change History (5)

comment:1 Changed 3 years ago by rtux

  • Cc fritsch+djangoproject.com@… added
  • Needs documentation unset
  • Needs tests unset
  • Patch needs improvement unset

comment:2 Changed 3 years ago by PaulM

  • Resolution set to wontfix
  • Status changed from new to closed

This is intentional and is not likely to change. We are looking at adding support for the Origin header, which has similar functionality, but we will not remove the requirement entirely. We only require the referer header in the case that you're coming from an SSL encrypted Django site back to that same site, in which case the privacy implications of blocking the header are pretty nonexistent.

Instead of blocking the header altogether, you might consider an addon that does something more intelligent like blocking it only when moving from one domain to another.

Unfortunately, this check is absolutely necessary for the security of Django's CSRF protection. Without it, we can't prevent man-in-the-middle attacks on SSL sites. We made the decision that preventing MITM was a more valuable tradeoff than breaking sites for the small minority of users who block the header in a fashion which does not improve privacy.

comment:3 Changed 3 years ago by rtux

Thank you for the detailed explanation!

comment:4 Changed 3 years ago by lukeplant

For reference, this Firefox add-on looks like it implements the kind of referer blocking you need: https://addons.mozilla.org/en-US/firefox/addon/smart-referer/

(I do not know if you are using Firefox or not).

comment:5 Changed 17 months ago by ilf

  • Version changed from 1.3 to 1.5

I'm hitting this on 1.5 and find it very annoying. There's also a lengthy discussion on this over here: https://bugs.launchpad.net/launchpad/+bug/560246

Add Comment

Modify Ticket

Change Properties
<Author field>
Action
as closed
as The resolution will be set. Next status will be 'closed'
The resolution will be deleted. Next status will be 'new'
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.