From 55fec16aafed30a9daa06d6ecdf8ca3ad361279e Mon Sep 17 00:00:00 2001 From: Holly Becker Date: Thu, 2 Jun 2016 17:24:48 -0700 Subject: Fixed #26628 -- Changed CSRF logger to django.security.csrf. --- docs/topics/logging.txt | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) (limited to 'docs/topics') diff --git a/docs/topics/logging.txt b/docs/topics/logging.txt index 6388018ff5..bee525d627 100644 --- a/docs/topics/logging.txt +++ b/docs/topics/logging.txt @@ -532,20 +532,23 @@ This logging does not include framework-level initialization (e.g. ``COMMIT``, and ``ROLLBACK``). Turn on query logging in your database if you wish to view all database queries. +.. _django-security-logger: + ``django.security.*`` ~~~~~~~~~~~~~~~~~~~~~~ The security loggers will receive messages on any occurrence of -:exc:`~django.core.exceptions.SuspiciousOperation`. There is a sub-logger for -each sub-type of SuspiciousOperation. The level of the log event depends on -where the exception is handled. Most occurrences are logged as a warning, while +:exc:`~django.core.exceptions.SuspiciousOperation` and other security-related +errors. There is a sub-logger for each subtype of security error, including all +``SuspiciousOperation``\s. The level of the log event depends on where the +exception is handled. Most occurrences are logged as a warning, while any ``SuspiciousOperation`` that reaches the WSGI handler will be logged as an error. For example, when an HTTP ``Host`` header is included in a request from a client that does not match :setting:`ALLOWED_HOSTS`, Django will return a 400 response, and an error message will be logged to the ``django.security.DisallowedHost`` logger. -These log events will reach the 'django' logger by default, which mails error +These log events will reach the ``django`` logger by default, which mails error events to admins when ``DEBUG=False``. Requests resulting in a 400 response due to a ``SuspiciousOperation`` will not be logged to the ``django.request`` logger, but only to the ``django.security`` logger. @@ -567,6 +570,10 @@ specific logger following this example: }, }, +Other ``django.security`` loggers not based on ``SuspiciousOperation`` are: + +* ``django.security.csrf``: For :ref:`CSRF failures `. + ``django.db.backends.schema`` ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- cgit v1.3