From 369fa471f46cd517edf5fc82e4ef6138de3cff6e Mon Sep 17 00:00:00 2001
From: Vaclav Ehrlich <vaclav.ehrlich@gmail.com>
Date: Sun, 3 Apr 2016 11:35:24 +0200
Subject: Fixed #26201 -- Documented the consequences of rotating the CSRF
 token on login.

---
 django/views/csrf.py | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'django')

diff --git a/django/views/csrf.py b/django/views/csrf.py
index f22f3b25ac..493e112fbe 100644
--- a/django/views/csrf.py
+++ b/django/views/csrf.py
@@ -78,6 +78,9 @@ CSRF_FAILURE_TEMPLATE = """
     <code>csrf_protect</code> on any views that use the <code>csrf_token</code>
     template tag, as well as those that accept the POST data.</li>
 
+    <li>The form has a valid CSRF token. After logging in in another browser
+    tab or hitting the back button after a login, you may need to reload the
+    page with the form, because the token is rotated after a login.</li>
   </ul>
 
   <p>You're seeing the help section of this page because you have <code>DEBUG =
-- 
cgit v1.3