diff options
| author | Raphael Michel <mail@raphaelmichel.de> | 2016-12-17 15:59:48 +0100 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2016-12-17 09:59:48 -0500 |
| commit | 33e86b3488dbf29f5aeb38cf0ee6597190d33c59 (patch) | |
| tree | 4bad1ccf20f1639f580248a8b323d0e3219236a4 /django | |
| parent | 2f44fa7f069427e2da18a0f6cb2ffc29699f2ca3 (diff) | |
Refs #16859 -- Disabled CSRF_COOKIE_* checks when using CSRF_USE_SESSIONS.
Diffstat (limited to 'django')
| -rw-r--r-- | django/core/checks/security/csrf.py | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/django/core/checks/security/csrf.py b/django/core/checks/security/csrf.py index b90308a016..1cd0ace56d 100644 --- a/django/core/checks/security/csrf.py +++ b/django/core/checks/security/csrf.py @@ -43,6 +43,7 @@ def check_csrf_middleware(app_configs, **kwargs): @register(Tags.security, deploy=True) def check_csrf_cookie_secure(app_configs, **kwargs): passed_check = ( + settings.CSRF_USE_SESSIONS or not _csrf_middleware() or settings.CSRF_COOKIE_SECURE ) @@ -52,6 +53,7 @@ def check_csrf_cookie_secure(app_configs, **kwargs): @register(Tags.security, deploy=True) def check_csrf_cookie_httponly(app_configs, **kwargs): passed_check = ( + settings.CSRF_USE_SESSIONS or not _csrf_middleware() or settings.CSRF_COOKIE_HTTPONLY ) |