django-csrf

Django CSRF cookie accessible by javascript?

由 二次信任 提交于 2019-12-01 08:45:39
On django website, https://docs.djangoproject.com/en/dev/ref/contrib/csrf/ it states: The CSRF protection is based on the following things: 1. A CSRF cookie that is set to a random value (a session independent nonce, as it is called), which other sites will not have access to. 2. ... Then, it also states the csrf token can be obtained from cookie by javascript: var csrftoken = $.cookie('csrftoken'); Aren't these two statements conflicting? Say there is a Cross Origin attack, then the attacker can just obtain the CSRF token from cookie, and then make a POST request with the CSRF token in the

Django CSRF cookie accessible by javascript?

由 瘦欲@ 提交于 2019-12-01 06:08:19
问题 On django website, https://docs.djangoproject.com/en/dev/ref/contrib/csrf/ it states: The CSRF protection is based on the following things: 1. A CSRF cookie that is set to a random value (a session independent nonce, as it is called), which other sites will not have access to. 2. ... Then, it also states the csrf token can be obtained from cookie by javascript: var csrftoken = $.cookie('csrftoken'); Aren't these two statements conflicting? Say there is a Cross Origin attack, then the attacker

How can I get a CSRF token from the command line?

由 只愿长相守 提交于 2019-12-01 04:14:56
问题 I'm frequently testing my application using curl and in the past I've had to simply wrap my views with csrf_exempt . I really don't want to do this, as I have a nasty feeling that I'll forget to do this in deployment and enjoy a lifetime of CSRF hell. Is there a way for me to request a CSRF token using Django's shell commands? I'd like to get a token I could send with my curl requests to test things safely. 回答1: Make an initial GET request to the form URL in order to fill the cookie jar: $

Pass Django CSRF token to Angular with CSRF_COOKIE_HTTPONLY

由 不想你离开。 提交于 2019-12-01 02:52:53
问题 In Django, when the CSRF_COOKIE_HTTPONLY setting is set to True, the CSRF cookie gains the httponly flag, which is desirable from a security perspective, but breaks the standard angular solution of adding this cookie to the httpProvider like so: $httpProvider.defaults.xsrfCookieName = 'csrftoken'; $httpProvider.defaults.xsrfHeaderName = 'X-CSRFToken'; Through Django 1.9, there was a workaround where you could just pass the cookie directly to the app by putting this in the template: <script>

Django : How to override the CSRF_FAILURE_TEMPLATE

由 一笑奈何 提交于 2019-11-30 12:22:35
If csrf checking fails, Django display a page with 403 error. It seems to me that this error can occur in regular use, for example, when the user disable cookie usage in his browser settings. Unfortunately, this error message is not very helpful for the end-user and has a "django-error" layout (this is a problem because for example the site navigation is missing). Django has a great mechanism for overriding templates but it seems that this template is hard-coded in the code. https://github.com/django/django/blob/1.6.8/django/views/csrf.py Is there a way to override this template in order to

Django bug on CRSF token

由 感情迁移 提交于 2019-11-30 09:48:57
问题 I am using django as web API for backend and React JS as web UI for frontend. User will sign up from web UI which will send a POST request to django to register with the user details. I want to protect the signup view with CSRF. Therefore I come out with steps below. First, once the sign up page is loaded, I fire a dummy GET request to store the csrf token with code below. handleSend(){ let req = { url: 'http://localhost:9000/vcubes/retrieve_token/', method : 'GET', withCredentials: true }

csrf error in django

由 自闭症网瘾萝莉.ら 提交于 2019-11-30 06:37:10
问题 I want to realize a login for my site. I basically copied and pasted the following bits from the Django Book together. However I still get an error (CSRF verification failed. Request aborted.), when submitting my registration form. Can somebody tell my what raised this error and how to fix it? Here is my code: views.py: # Create your views here. from django import forms from django.contrib.auth.forms import UserCreationForm from django.http import HttpResponseRedirect from django.shortcuts

Django - CSRF token missing or incorrect

由 送分小仙女□ 提交于 2019-11-30 02:14:47
问题 I just updated my django to 1.4. But I am getting the following error when I try to submit my login form: Forbidden (403) CSRF verification failed. Request aborted. Reason given for failure: CSRF token missing or incorrect. In my settings.py (MIDDLEWARE_CLASSES) I had to remove the following line because its now deprecated: 'django.middleware.csrf.CsrfResponseMiddleware', And than I started to to get this error. Some necessary information: Urls.py url(r'^login/$', 'django.contrib.auth.views

Django : How to override the CSRF_FAILURE_TEMPLATE

由 五迷三道 提交于 2019-11-29 17:10:38
问题 If csrf checking fails, Django display a page with 403 error. It seems to me that this error can occur in regular use, for example, when the user disable cookie usage in his browser settings. Unfortunately, this error message is not very helpful for the end-user and has a "django-error" layout (this is a problem because for example the site navigation is missing). Django has a great mechanism for overriding templates but it seems that this template is hard-coded in the code. https://github

CSRF Protection in Django 1.4

由 眉间皱痕 提交于 2019-11-29 11:30:12
I am trying to learn django by working through "The Django Book", and I'm having a problem with CSRF protection. I've found lots of suggestions here, but none seem to work for me. Using Chrome I get the message: CSRF token missing or incorrect . Using Internet Explorer I get the message: CSRF cookie not set . If I comment out 'django.middleware.csrf.CsrfViewMiddleware' in settings.py, everything seems to work (although nothing gets mailed to the phony address of course.) I've tried putting a csrf_protect decorator on my view, but it doesn't help. I've also tried commenting out the call to send
订阅 django-csrf