mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-08-04 19:08:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Fixed #16010 -- Added Origin header checking to CSRF middleware.

Browse source 
Thanks David Benjamin for the original patch, and Florian
Apolloner, Chris Jerdonek, and Adam Johnson for reviews.
This commit is contained in:
Tim Graham 2021-01-02 18:46:17 -05:00 • committed by Mariusz Felisiak
parent dba44a7a7a
commit 2411b8b5eb
5 changed files with 238 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

18
docs/ref/csrf.txt
View file

@ -263,10 +263,15 @@ The CSRF protection is based on the following things:
This check is done by ``CsrfViewMiddleware``.
#. In addition, for HTTPS requests, strict referer checking is done by
``CsrfViewMiddleware``. This means that even if a subdomain can set or
modify cookies on your domain, it can't force a user to post to your
application since that request won't come from your own exact domain.
#. ``CsrfViewMiddleware`` verifies the `Origin header`_, if provided by the
browser, against the current host and the :setting:`CSRF_TRUSTED_ORIGINS`
setting. This provides protection against cross-subdomain attacks.
#. In addition, for HTTPS requests, if the ``Origin`` header isn't provided,
``CsrfViewMiddleware`` performs strict referer checking. This means that
even if a subdomain can set or modify cookies on your domain, it can't force
a user to post to your application since that request won't come from your
own exact domain.
This also addresses a man-in-the-middle attack that's possible under HTTPS
when using a session independent secret, due to the fact that HTTP
@ -284,6 +289,10 @@ The CSRF protection is based on the following things:
Expanding the accepted referers beyond the current host or cookie domain can
be done with the :setting:`CSRF_TRUSTED_ORIGINS` setting.
.. versionadded:: 4.0
``Origin`` checking was added, as described above.
This ensures that only forms that have originated from trusted domains can be
used to POST data back.
@ -314,6 +323,7 @@ vulnerability allows and much worse).
sites.
.. _BREACH: http://breachattack.com/
.. _Origin header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin
.. _disable the referer: https://www.w3.org/TR/referrer-policy/#referrer-policy-delivery
Caching