Release notes Archive of security issues
Potential CSRF via Host header. Full description
309 sections across all versions Narrow to Django 6.0 (current) →
Release notes Archive of security issues
CSRF via forged HTTP headers. Full description
Release notes Django 1.11 release notes Features deprecated in 1.11
CSRF failures are logged to the django.security.csrf logger instead of django.request. ALLOWED_HOSTS validation is no longer disabled when running tests. If your application includes tests with custom host names, you must include those host names in ALLOWED_HOSTS.
Release notes Django 1.2 release notes
Vastly improved protection against Cross-Site Request Forgery (CSRF). A new user “messages” framework with support for cookie- and session-based message for both anonymous and authenticated users. Hooks for object-level permissions, permissions for anonymous users, and more flexible username requirements.
Release notes Django 2.1 release notes Backwards incompatible changes in 2.1
The cookies used for django.contrib.sessions, django.contrib.messages, and Django’s CSRF protection now set the SameSite flag to Lax by default. Browsers that respect this flag won’t send these cookies on cross-origin requests.
Release notes Archive of security issues Issues under Django’s security process
CSRF protection bypass on a site with Google Analytics. Full description
Release notes Archive of security issues Issues under Django’s security process
Potential CSRF via Host header. Full description
Release notes Archive of security issues Issues under Django’s security process
CSRF via forged HTTP headers. Full description
Release notes Archive of security issues Issues under Django’s security process
CSRF via preservation of POST data during admin login. Full description
Release notes Archive of security issues
CSRF via preservation of POST data during admin login. Full description
Release notes Django 1.2.2 release notes
In order to test a bug fix that forms part of the 1.2.2 release, it was necessary to add a feature – the enforce_csrf_checks flag – to the test client.
Release notes Django 1.6 release notes
… HTTP header, and this header is being set on a variety of occasions, such as: accessing the session, or using CSRF protection, which is turned on by default, or using a client-side library which sets cookies, like Google Analytics. This …
Release notes Django 1.7.3 release notes
Fixed a crash in the CSRF middleware when handling non-ASCII referer header (#23815). Fixed a crash in the django.contrib.auth.redirect_to_login view when passing a reverse_lazy() result on Python 3 (#24097). Added correct formats for Greek (el) (#23967).
Release notes Django 1.8.3 release notes
Corrected HStoreField.has_changed() (#24844). Reverted an optimization to the CSRF template context processor which caused a regression (#24836). Fixed a regression which caused template context processors to overwrite variables set on a RequestContext after it’s created (#24847).
Release notes Django 6.2 release notes - UNDER DEVELOPMENT
QUERY is treated as a safe method throughout Django: it is exempt from CSRF protection, it participates in conditional request processing via ConditionalGetMiddleware and condition(), and it is accepted by require_safe().
Release notes Django 1.2.2 release notes
In order to test a bug fix that forms part of the 1.2.2 release, it was necessary to add a feature – the enforce_csrf_checks flag – to the test client.
Release notes Django 1.6 release notes Features deprecated in 1.6
… HTTP header, and this header is being set on a variety of occasions, such as: accessing the session, or using CSRF protection, which is turned on by default, or using a client-side library which sets cookies, like Google Analytics. This …
Release notes Django 1.7.3 release notes
Fixed a crash in the CSRF middleware when handling non-ASCII referer header (#23815). Fixed a crash in the django.contrib.auth.redirect_to_login view when passing a reverse_lazy() result on Python 3 (#24097). Added correct formats for Greek (el) (#23967).
Release notes Django 1.8.3 release notes
Corrected HStoreField.has_changed() (#24844). Reverted an optimization to the CSRF template context processor which caused a regression (#24836). Fixed a regression which caused template context processors to overwrite variables set on a RequestContext after it’s created (#24847).
Release notes Django 1.2 release notes
For example, you would change code from this: to this: or: For those of you who’ve been following the development trunk, this change also applies to other decorators introduced since 1.1, including csrf_protect, cache_control and anything created using decorator_from_middleware.