From bae66e759faee8513da4b11d3fd16b044b415bdb Mon Sep 17 00:00:00 2001 From: Carlton Gibson Date: Tue, 22 Jan 2019 09:56:48 +0100 Subject: Fixed #30091 -- Doc'd middleware ordering requirements with CSRF_USE_SESSIONS. --- docs/ref/settings.txt | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'docs/ref/settings.txt') diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt index ef83842aa0..a4be583003 100644 --- a/docs/ref/settings.txt +++ b/docs/ref/settings.txt @@ -403,6 +403,12 @@ Storing the CSRF token in a cookie (Django's default) is safe, but storing it in the session is common practice in other web frameworks and therefore sometimes demanded by security auditors. +Since the :ref:`default error views ` require the CSRF token, +:class:`~django.contrib.sessions.middleware.SessionMiddleware` must appear in +:setting:`MIDDLEWARE` before any middleware that may raise an exception to +trigger an error view (such as :exc:`~django.core.exceptions.PermissionDenied`) +if you're using ``CSRF_USE_SESSIONS``. See :ref:`middleware-ordering`. + .. setting:: CSRF_FAILURE_VIEW ``CSRF_FAILURE_VIEW`` -- cgit v1.3