id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
24496	Check CSRF Referer against CSRF_COOKIE_DOMAIN	Matt Robenolt	Joshua Kehn	"Right now, if you try to share a CSRF token across a subdomain without https, everything works great since the Referer header isn't validated.

But over https, we want to be a bit more strict and make sure that the Referer is from another secure site, and also that the Referer matches where we think it should be coming from. The canonical source for where we think it should be from is `CSRF_COOKIE_DOMAIN`.

If we set our `CSRF_COOKIE_DOMAIN` to `.example.com`, that means our CSRF validation should work for `www.example.com` and `foo.example.com`. Not just strictly the domain the request is coming from."	New feature	assigned	CSRF	dev	Normal		csrf	django@…	Accepted	1	1	0	0	0	0