Document the consequences of rotating the CSRF token on login

[Wim Feijen]

Hello,

When debug is set to False, my customers can be confronted with a yellow error screen, saying:

Forbidden (403)

CSRF verification failed. Request aborted.

I believe this happens when some-one has two tabs open. He logs in and out in one tab. Then, in the other tab he fills in a form which now holds an invalid csrf-token.

I would like this error to be end-user friendly: meaning I'd rather show him a default 404-page which is defined by me and is worded in a way the end user understands. And I would like to receive an error message.

Thanks! Wim

[Aymeric Augustin]

I think this is a false positive of the CSRF protection. It happens because the CSRF token is rotated on login.

It was likely discussed on the mailing list or in another ticket before but I don't remember the outcome.

[Tim Graham]

As for how to customize the CSRF error page, ​see the docs.

I'll accept this ticket to add an FAQ to the list started in #26165. In his security talk at ​Django Under the Hood 2015, Florian said rotating the token on login "is a security feature and won't change."

[Wim Feijen]

Hi thanks Aymeric and Tim for your quick response and reference!

My additional proposal would be to change the wording of the error message to something an end-user would understand, for example:

Access forbidden (403 error)

Please reload the page to try again.

Your request was aborted due to a CSRF verification failure.

Please report to the site's administrator if the problem persists.

[Collin Anderson]

This happens to my users pretty frequently for whatever reason (possibly the back button is involved). Reloading the POST request doesn't fix it, because it will re-POST the old csrf token. The user needs to press back, reload (GET) the page, and then re-submit the form.

[Tim Graham]

​PR

[Tim Graham <timograham@…>]

In 369fa47:

Fixed #26201 -- Documented the consequences of rotating the CSRF token on login.

[Tim Graham <timograham@…>]

In 147f9a0d:

[1.9.x] Fixed #26201 -- Documented the consequences of rotating the CSRF token on login.

Backport of 369fa471f46cd517edf5fc82e4ef6138de3cff6 from master