309 sections across all versions Narrow to Django 6.0 (current) →
Release notes Django 1.2 release notes Features deprecated in 1.2
CsrfResponseMiddleware, the middleware that automatically inserted CSRF tokens into POST forms in outgoing pages, has been deprecated in favor of a template tag method (see above), and will be removed completely in Django 1.4.
Release notes Django 4.1 release notes
The new CSRF_COOKIE_MASKED transitional setting allows specifying whether to mask the CSRF cookie. CsrfViewMiddleware no longer masks the CSRF cookie like it does the CSRF token in the DOM.
Release notes Django 4.1 release notes What’s new in Django 4.1
The new CSRF_COOKIE_MASKED transitional setting allows specifying whether to mask the CSRF cookie. CsrfViewMiddleware no longer masks the CSRF cookie like it does the CSRF token in the DOM.
Release notes Django 1.2 release notes
We’ve made large changes to the way CSRF protection works, detailed in the CSRF documentation.
Release notes Django 1.2 release notes Backwards-incompatible changes in 1.2
We’ve made large changes to the way CSRF protection works, detailed in the CSRF documentation.
Release notes Django 1.10 release notes
CSRF token values are now required to be strings of 64 alphanumerics; values of 32 alphanumerics, as set by older versions of Django by default, are automatically replaced by strings of 64 characters. Other values are considered invalid.
Release notes Archive of security issues
Caching of anonymous pages could reveal CSRF token. Full description
Release notes Django 1.10 release notes Features deprecated in 1.10
CSRF token values are now required to be strings of 64 alphanumerics; values of 32 alphanumerics, as set by older versions of Django by default, are automatically replaced by strings of 64 characters. Other values are considered invalid.
Release notes Archive of security issues Issues under Django’s security process
Caching of anonymous pages could reveal CSRF token. Full description
Release notes Django 5.0 release notes
The following decorators now support wrapping asynchronous view functions: cache_control() never_cache() no_append_slash() csrf_exempt() csrf_protect() ensure_csrf_cookie() requires_csrf_token() sensitive_variables() sensitive_post_parameters() gzip_page() condition() conditional_page() etag() last_modified() require_http_methods() require_GET() require_POST() require_safe() vary_on_cookie() vary_on_headers() xframe_options_deny() xframe_options_sameorigin() xframe_options_exempt()
Release notes Django 5.0 release notes What’s new in Django 5.0Minor features
The following decorators now support wrapping asynchronous view functions: cache_control() never_cache() no_append_slash() csrf_exempt() csrf_protect() ensure_csrf_cookie() requires_csrf_token() sensitive_variables() sensitive_post_parameters() gzip_page() condition() conditional_page() etag() last_modified() require_http_methods() require_GET() require_POST() require_safe() vary_on_cookie() vary_on_headers() xframe_options_deny() xframe_options_sameorigin() xframe_options_exempt()
Release notes
This release corrects the following problems: The patch applied for the security issue covered in Django 1.2.2 caused issues with non-ASCII responses using CSRF tokens.
Release notes
This release corrects the following problems: The patch applied for the security issue covered in Django 1.2.2 caused issues with non-ASCII responses using CSRF tokens.
Release notes Django 1.1.2 release notes
Django 1.2 (the next major release of Django) will contain a feature that will improve protection against Cross-Site Request Forgery (CSRF) attacks. This feature requires the use of a new csrf_token template tag in all forms that Django renders.
Release notes Django 1.11.6 release notes
Fixed a regression in Django 1.9 where a custom view error handler such as handler404 that accesses csrf_token could cause CSRF verification failures on other pages (#28488).
Release notes Django 1.5.2 release notes
The CSRF token now rotates when a user logs in. Some Python 3 compatibility fixes including #20212 and #20025. Fixed some rare cases where get() exceptions recursed infinitely (#20278). makemessages no longer crashes with UnicodeDecodeError (#20354).
Release notes Django 4.1 release notes
CsrfViewMiddleware no longer masks the CSRF cookie like it does the CSRF token in the DOM. CsrfViewMiddleware now uses request.META['CSRF_COOKIE'] for storing the unmasked CSRF secret rather than a masked version. This is an undocumented, private API.
Release notes Django 4.1 release notes
Logging out via GET requests to the built-in logout view is deprecated. Use POST requests instead.
Release notes Django 1.1.2 release notes
Django 1.2 (the next major release of Django) will contain a feature that will improve protection against Cross-Site Request Forgery (CSRF) attacks. This feature requires the use of a new csrf_token template tag in all forms that Django renders.
Release notes Django 1.11.6 release notes
Fixed a regression in Django 1.9 where a custom view error handler such as handler404 that accesses csrf_token could cause CSRF verification failures on other pages (#28488).