mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-07-24 05:36:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

[1.10.x] Fixed #27352 -- Doc'd social media fingerprinting consideration with login's redirect_authenticated_user.

Browse source 
Backport of b5fc192b99 from master
This commit is contained in:
Markus Holtermann 2016-10-15 20:32:19 +02:00 • committed by Tim Graham
parent 64e4adbfef
commit d3ca290778
2 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
docs/spelling_wordlist
View file

@ -253,6 +253,7 @@ fallback
fallbacks
faq
FastCGI
favicon
fieldset
fieldsets
filename

9
docs/topics/auth/default.txt
View file

@ -999,6 +999,15 @@ implementation details see :ref:`using-the-views`.
authenticated users accessing the login page will be redirected as if
they had just successfully logged in. Defaults to ``False``.
.. warning::
If you enable ``redirect_authenticated_user``, other websites will be
able to determine if their visitors are authenticated on your site by
requesting redirect URLs to image files on your website. To avoid
this "`social media fingerprinting
<https://robinlinus.github.io/socialmedia-leak/>`_" information
leakage, host all images and your favicon on a separate domain.
.. deprecated:: 1.9
The ``current_app`` parameter is deprecated and will be removed in