diff options
Diffstat (limited to 'django')
| -rw-r--r-- | django/conf/global_settings.py | 1 | ||||
| -rw-r--r-- | django/middleware/csrf.py | 2 |
2 files changed, 2 insertions, 1 deletions
diff --git a/django/conf/global_settings.py b/django/conf/global_settings.py index 41abd4f499..d817ea8e94 100644 --- a/django/conf/global_settings.py +++ b/django/conf/global_settings.py @@ -555,6 +555,7 @@ CSRF_COOKIE_DOMAIN = None CSRF_COOKIE_PATH = '/' CSRF_COOKIE_SECURE = False CSRF_COOKIE_HTTPONLY = False +CSRF_HEADER_NAME = 'HTTP_X_CSRFTOKEN' ############ # MESSAGES # diff --git a/django/middleware/csrf.py b/django/middleware/csrf.py index f12126fa9f..8891a44109 100644 --- a/django/middleware/csrf.py +++ b/django/middleware/csrf.py @@ -183,7 +183,7 @@ class CsrfViewMiddleware(object): if request_csrf_token == "": # Fall back to X-CSRFToken, to make things easier for AJAX, # and possible for PUT/DELETE. - request_csrf_token = request.META.get('HTTP_X_CSRFTOKEN', '') + request_csrf_token = request.META.get(settings.CSRF_HEADER_NAME, '') if not constant_time_compare(request_csrf_token, csrf_token): return self._reject(request, REASON_BAD_TOKEN) |