diff options
| author | Russell Keith-Magee <russell@keith-magee.com> | 2007-08-17 15:05:54 +0000 |
|---|---|---|
| committer | Russell Keith-Magee <russell@keith-magee.com> | 2007-08-17 15:05:54 +0000 |
| commit | fcec755f01cfaba2a85bfc9511876debbce98631 (patch) | |
| tree | e990effbcd90e4d405b0f9dcc70cb38e47b6f3dc /docs/csrf.txt | |
| parent | 0f92ac52cbf81fb2ac01755c558e2e6ad54700e8 (diff) | |
newforms-admin: Merged from trunk up to [5916]
git-svn-id: http://code.djangoproject.com/svn/django/branches/newforms-admin@5918 bcc190cf-cafb-0310-a4f2-bffc1f526a37
Diffstat (limited to 'docs/csrf.txt')
| -rw-r--r-- | docs/csrf.txt | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/docs/csrf.txt b/docs/csrf.txt index c12dd1d116..7d79e39502 100644 --- a/docs/csrf.txt +++ b/docs/csrf.txt @@ -41,10 +41,10 @@ CsrfMiddleware does two things: This ensures that only forms that have originated from your web site can be used to POST data back. -It deliberately only targets HTTP POST requests (and the corresponding -POST forms). GET requests ought never to have side effects (if you are -using HTTP GET and POST correctly), and so a CSRF attack with a GET -request will always be harmless. +It deliberately only targets HTTP POST requests (and the corresponding POST +forms). GET requests ought never to have any potentially dangerous side +effects (see `9.1.1 Safe Methods, HTTP 1.1, RFC 2616`_), and so a +CSRF attack with a GET request ought to be harmless. POST requests that are not accompanied by a session cookie are not protected, but they do not need to be protected, since the 'attacking' web site @@ -54,6 +54,8 @@ The Content-Type is checked before modifying the response, and only pages that are served as 'text/html' or 'application/xml+xhtml' are modified. +.. _9.1.1 Safe Methods, HTTP 1.1, RFC 2616: http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html + Limitations =========== |