From eef95ea96faef0b7dbbe0c8092202b74f68a899b Mon Sep 17 00:00:00 2001 From: Jay Cox Date: Thu, 23 Apr 2015 23:24:38 -0700 Subject: Fixed #24696 -- Made CSRF_COOKIE computation lazy. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Only compute the CSRF_COOKIE when it is actually used. This is a significant speedup for clients not using cookies. Changed result of the “test_token_node_no_csrf_cookie” test: It gets a valid CSRF token now which seems like the correct behavior. Changed auth_tests.test_views.LoginTest.test_login_csrf_rotate to use get_token() to trigger CSRF cookie inclusion instead of changing request.META["CSRF_COOKIE_USED"] directly. --- django/middleware/csrf.py | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) (limited to 'django') diff --git a/django/middleware/csrf.py b/django/middleware/csrf.py index 8891a44109..6d16a92bf5 100644 --- a/django/middleware/csrf.py +++ b/django/middleware/csrf.py @@ -40,15 +40,17 @@ def _get_new_csrf_key(): def get_token(request): """ Returns the CSRF token required for a POST form. The token is an - alphanumeric value. + alphanumeric value. A new token is created if one is not already set. A side effect of calling this function is to make the csrf_protect decorator and the CsrfViewMiddleware add a CSRF cookie and a 'Vary: Cookie' header to the outgoing response. For this reason, you may need to use this function lazily, as is done by the csrf context processor. """ + if "CSRF_COOKIE" not in request.META: + request.META["CSRF_COOKIE"] = _get_new_csrf_key() request.META["CSRF_COOKIE_USED"] = True - return request.META.get("CSRF_COOKIE", None) + return request.META["CSRF_COOKIE"] def rotate_token(request): @@ -112,9 +114,6 @@ class CsrfViewMiddleware(object): request.META['CSRF_COOKIE'] = csrf_token except KeyError: csrf_token = None - # Generate token and store it in the request, so it's - # available to the view. - request.META["CSRF_COOKIE"] = _get_new_csrf_key() # Wait until request.META["CSRF_COOKIE"] has been manipulated before # bailing out, so that get_token still works @@ -194,12 +193,6 @@ class CsrfViewMiddleware(object): if getattr(response, 'csrf_processing_done', False): return response - # If CSRF_COOKIE is unset, then CsrfViewMiddleware.process_view was - # never called, probably because a request middleware returned a response - # (for example, contrib.auth redirecting to a login page). - if request.META.get("CSRF_COOKIE") is None: - return response - if not request.META.get("CSRF_COOKIE_USED", False): return response -- cgit v1.3