Reference System check framework Core system checks

security.W003: You don’t appear to be using Django’s built-in cross-site request forgery protection via the middleware (django.middleware.csrf.CsrfViewMiddleware is not in your MIDDLEWARE). Enabling the middleware is the safest approach to ensure you don’t leave any holes.

Index

… csp() (in module django.template.context_processors) - csp_nonce_attr - template tag - csp_override() (in module django.views.decorators.csp) - csp_report_only_override() (in module django.views.decorators.csp) - CSRF_COOKIE_AGE - setting - CSRF_COOKIE_DOMAIN - setting - CSRF_COOKIE_HTTPONLY - setting - CSRF_COOKIE_NAME - setting - CSRF_COOKIE_PATH - setting - …

Index

… attribute) - required_db_vendor (Options attribute) - REQUIRED_FIELDS (models.CustomUser attribute) - RequireDebugFalse (class in django.utils.log) - RequireDebugTrue (class in django.utils.log) - requires_csrf_token() (in module django.views.decorators.csrf) - requires_migrations_checks (BaseCommand attribute) - requires_settings (BaseCommand attribute) - requires_system_checks (BaseCommand attribute) - reset_sequences (TransactionTestCase attribute) …

Release notes Django 1.5.5 release notes

This behavior introduced as a security hardening measure in Django 1.5.2 did not work properly and is now fixed.

Release notes Django 1.4.11 release notes

Django includes both a caching framework and a system for preventing cross-site request forgery (CSRF) attacks.

Release notes Django 1.5.6 release notes

Django includes both a caching framework and a system for preventing cross-site request forgery (CSRF) attacks.

Release notes Django 1.6.3 release notes

Django includes both a caching framework and a system for preventing cross-site request forgery (CSRF) attacks.

Release notes Django 1.1.4 release notes Backwards incompatible changes

Django includes a CSRF-protection mechanism, which makes use of a token inserted into outgoing forms. Middleware then checks for the token’s presence on form submission, and validates it.

Release notes Django 1.11 release notes What’s new in Django 1.11Minor features

Added the CSRF_USE_SESSIONS setting to allow storing the CSRF token in the user’s session rather than in a cookie.

Release notes Django 1.2.5 release notes Backwards incompatible changes

Django includes a CSRF-protection mechanism, which makes use of a token inserted into outgoing forms. Middleware then checks for the token’s presence on form submission, and validates it.

Release notes Django 1.2 release notes Features deprecated in 1.2

CsrfResponseMiddleware, the middleware that automatically inserted CSRF tokens into POST forms in outgoing pages, has been deprecated in favor of a template tag method (see above), and will be removed completely in Django 1.4.

Release notes Django 4.1 release notes What’s new in Django 4.1

The new CSRF_COOKIE_MASKED transitional setting allows specifying whether to mask the CSRF cookie. CsrfViewMiddleware no longer masks the CSRF cookie like it does the CSRF token in the DOM.

Release notes Django 1.2 release notes Backwards-incompatible changes in 1.2

We’ve made large changes to the way CSRF protection works, detailed in the CSRF documentation.

Release notes Django 1.10 release notes Features deprecated in 1.10

CSRF token values are now required to be strings of 64 alphanumerics; values of 32 alphanumerics, as set by older versions of Django by default, are automatically replaced by strings of 64 characters. Other values are considered invalid.

Release notes Archive of security issues Issues under Django’s security process

Caching of anonymous pages could reveal CSRF token. Full description

Release notes Django 5.0 release notes What’s new in Django 5.0Minor features

The following decorators now support wrapping asynchronous view functions: cache_control() never_cache() no_append_slash() csrf_exempt() csrf_protect() ensure_csrf_cookie() requires_csrf_token() sensitive_variables() sensitive_post_parameters() gzip_page() condition() conditional_page() etag() last_modified() require_http_methods() require_GET() require_POST() require_safe() vary_on_cookie() vary_on_headers() xframe_options_deny() xframe_options_sameorigin() xframe_options_exempt()

Release notes

This release corrects the following problems: The patch applied for the security issue covered in Django 1.2.2 caused issues with non-ASCII responses using CSRF tokens.

Release notes Django 1.1.2 release notes

Django 1.2 (the next major release of Django) will contain a feature that will improve protection against Cross-Site Request Forgery (CSRF) attacks. This feature requires the use of a new csrf_token template tag in all forms that Django renders.

Release notes Django 1.11.6 release notes

Fixed a regression in Django 1.9 where a custom view error handler such as handler404 that accesses csrf_token could cause CSRF verification failures on other pages (#28488).

Release notes Django 1.5.2 release notes

The CSRF token now rotates when a user logs in. Some Python 3 compatibility fixes including #20212 and #20025. Fixed some rare cases where get() exceptions recursed infinitely (#20278). makemessages no longer crashes with UnicodeDecodeError (#20354).