Commit ac4fec5c authored by Tim Graham's avatar Tim Graham
Browse files

Fixed bug causing CSRF token not to rotate on login. 

Thanks Gavin McQuillan for the report.
parent a8000369

django/contrib/auth/tests/test_views.py

+0 −1
Original line number Diff line number Diff line
@@ -531,7 +531,6 @@ class LoginTest(AuthViewsTestCase): 
        CsrfViewMiddleware().process_view(req, login_view, (), {})

        req.META["SERVER_NAME"] = "testserver"  # Required to have redirect work in login view

        req.META["SERVER_PORT"] = 80

        req.META["CSRF_COOKIE_USED"] = True

        resp = login_view(req)

        resp2 = CsrfViewMiddleware().process_response(req, resp)

        csrf_cookie = resp2.cookies.get(settings.CSRF_COOKIE_NAME, None)

django/middleware/csrf.py

+4 −1
Original line number Diff line number Diff line
@@ -56,7 +56,10 @@ def rotate_token(request): 
    Changes the CSRF token in use for a request - should be done on login

    for security purposes.

    """

    request.META["CSRF_COOKIE"] = _get_new_csrf_key()

    request.META.update({

        "CSRF_COOKIE_USED": True,

        "CSRF_COOKIE": _get_new_csrf_key(),

    })





def _sanitize_token(token):