mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-08-04 19:08:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Updated documentation and comments for RFC updates.

Browse source 
- Updated references to RFC 1123 to RFC 5322
  - Only partial as RFC 5322 sort of sub-references RFC 1123.
- Updated references to RFC 2388 to RFC 7578
  - Except RFC 2388 Section 5.3 which has no equivalent.
- Updated references to RFC 2396 to RFC 3986
- Updated references to RFC 2616 to RFC 9110
- Updated references to RFC 3066 to RFC 5646
- Updated references to RFC 7230 to RFC 9112
- Updated references to RFC 7231 to RFC 9110
- Updated references to RFC 7232 to RFC 9110
- Updated references to RFC 7234 to RFC 9111
- Tidied up style of text when referring to RFC documents
This commit is contained in:
Nick Pope 2022-11-04 12:33:09 +00:00 • committed by Mariusz Felisiak
parent fad070b07b
commit 9bd174b9a7
34 changed files with 97 additions and 103 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/ref/csrf.txt
View file

@ -14,7 +14,7 @@ who visits the malicious site in their browser. A related type of attack,
a site with someone else's credentials, is also covered.
The first defense against CSRF attacks is to ensure that GET requests (and other
'safe' methods, as defined by :rfc:`7231#section-4.2.1`) are side effect free.
'safe' methods, as defined by :rfc:`9110#section-9.2.1`) are side effect free.
Requests via 'unsafe' methods, such as POST, PUT, and DELETE, can then be
protected by the steps outlined in :ref:`using-csrf`.
@ -90,9 +90,9 @@ This ensures that only forms that have originated from trusted domains can be
used to POST data back.
It deliberately ignores GET requests (and other requests that are defined as
'safe' by :rfc:`7231#section-4.2.1`). These requests ought never to have any
'safe' by :rfc:`9110#section-9.2.1`). These requests ought never to have any
potentially dangerous side effects, and so a CSRF attack with a GET request
ought to be harmless. :rfc:`7231#section-4.2.1` defines POST, PUT, and DELETE
ought to be harmless. :rfc:`9110#section-9.2.1` defines POST, PUT, and DELETE
as 'unsafe', and all other methods are also assumed to be unsafe, for maximum
protection.