diff options
| author | Flávio Juvenal <flaviojuvenal@gmail.com> | 2017-05-24 16:36:45 -0700 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2017-06-22 11:50:00 -0400 |
| commit | 0af14b2eaa0bf0821a8aacc8486489a1eb348397 (patch) | |
| tree | 36aeed00ae415f909278cea45e3d242990e39599 /django | |
| parent | e1cd5a76d739210ae3b45d2c5f1ac7a556d6fa53 (diff) | |
Refs #16870 -- Doc'd that CSRF protection requires the Referer header.
Diffstat (limited to 'django')
| -rw-r--r-- | django/views/csrf.py | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/django/views/csrf.py b/django/views/csrf.py index 6119f3b49d..0689df84e4 100644 --- a/django/views/csrf.py +++ b/django/views/csrf.py @@ -41,6 +41,7 @@ CSRF_FAILURE_TEMPLATE = """ {% if no_referer %} <p>{{ no_referer1 }}</p> <p>{{ no_referer2 }}</p> + <p>{{ no_referer3 }}</p> {% endif %} {% if no_cookie %} <p>{{ no_cookie1 }}</p> @@ -119,6 +120,13 @@ def csrf_failure(request, reason="", template_name=CSRF_FAILURE_TEMPLATE_NAME): "If you have configured your browser to disable 'Referer' headers, " "please re-enable them, at least for this site, or for HTTPS " "connections, or for 'same-origin' requests."), + 'no_referer3': _( + "If you are using the <meta name=\"referrer\" " + "content=\"no-referrer\"> tag or including the 'Referrer-Policy: " + "no-referrer' header, please remove them. The CSRF protection " + "requires the 'Referer' header to do strict referer checking. If " + "you're concerned about privacy, use alternatives like " + "<a rel=\"noreferrer\" ...> for links to third-party sites."), 'no_cookie': reason == REASON_NO_CSRF_COOKIE, 'no_cookie1': _( "You are seeing this message because this site requires a CSRF " |