Changes between Version 2 and Version 5 of Ticket #25334


Ignore:
Timestamp:
Sep 3, 2015, 9:23:20 AM (9 years ago)
Author:
Joshua Kehn
Comment:

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #25334

    • Property Triage Stage Unreviewed → Accepted

  • Ticket #25334 – Description

    v2 v5  
    11Django's CSRF implementation (when used over HTTPS) validates that the Referer header matches the current host (i.e. that the request is coming from the same domain).
    22
    3 There are cases where it is reasonable to allow non-same-origin CSRF-protected requests. Ticket #24996 (which also contains some discussion relevant to this ticket) has a pull request to allow any host that matches `CSRF_COOKIE_DOMAIN` past the Referer check; this takes care of the common subdomain cases.
     3There are cases where it is reasonable to allow non-same-origin CSRF-protected requests. Ticket #24496 (which also contains some discussion relevant to this ticket) has a pull request to allow any host that matches `CSRF_COOKIE_DOMAIN` past the Referer check; this takes care of the common subdomain cases.
    44
    55But there also cases where a totally separate domain may be allowed to make `POST` (etc) requests to an API via CORS, and CORS headers can be configured to allow XHR requests from that external domain to send cookies to the API (including the CSRF cookie). But at the moment such a technique falls afoul of the Referer checking, and the only way to bypass it is by monkeypatching the request headers (that's what https://github.com/ottoyiu/django-cors-headers does).
Back to Top