Ticket #24496: 24496.diff

django/conf/global_settings.py

@@ -558 +558 @@
 CSRF_COOKIE_SECURE = False
 CSRF_COOKIE_HTTPONLY = False
 CSRF_HEADER_NAME = 'HTTP_X_CSRFTOKEN'
+CSRF_TRUSTED_ORIGINS = []
 
 ############
 # MESSAGES #

django/middleware/csrf.py

@@ -19 +19 @@
 logger = logging.getLogger('django.request')
 
 REASON_NO_REFERER = "Referer checking failed - no Referer."
-REASON_BAD_REFERER = "Referer checking failed - %s does not match %s."
+REASON_BAD_REFERER = "Referer checking failed - %s does not match any allowed hosts."
 REASON_NO_CSRF_COOKIE = "CSRF cookie not set."
 REASON_BAD_TOKEN = "CSRF token missing or incorrect."
 
@@ -154 +154 @@
                 if referer is None:
                     return self._reject(request, REASON_NO_REFERER)
 
+                # Here we generate a list of all acceptable HTTP referers,
+                # including the current host since that has been validated
+                # upstream.
+                #
                 # Note that request.get_host() includes the port.
-                good_referer = 'https://%s/' % request.get_host()
-                if not same_origin(referer, good_referer):
-                    reason = REASON_BAD_REFERER % (referer, good_referer)
+                good_hosts = list(settings.CSRF_TRUSTED_ORIGINS)
+                good_hosts.append(request.get_host())
+                good_referers = ['https://{0}/'.format(host) for host in good_hosts]
+                if not any([same_origin(referer, host) for host in good_referers]):
+                    reason = REASON_BAD_REFERER % (referer)
                     return self._reject(request, reason)
 
             if csrf_token is None:

docs/ref/csrf.txt

@@ -257 +257 @@
    due to the fact that HTTP 'Set-Cookie' headers are (unfortunately) accepted
    by clients that are talking to a site under HTTPS.  (Referer checking is not
    done for HTTP requests because the presence of the Referer header is not
-   reliable enough under HTTP.)
+   reliable enough under HTTP.) Expanding the accepted referers beyond the current host can be done with the :setting:`CSRF_TRUSTED_ORIGINS` setting.
 
 This ensures that only forms that have originated from your Web site can be used
 to POST data back.
@@ -460 +460 @@
 * :setting:`CSRF_COOKIE_SECURE`
 * :setting:`CSRF_FAILURE_VIEW`
 * :setting:`CSRF_HEADER_NAME`
+* :setting:`CSRF_TRUSTED_ORIGINS`

docs/ref/settings.txt

@@ -428 +428 @@
 For example, if your client sends a ``'X-XSRF-TOKEN'`` header, the setting
 should be ``'HTTP_X_XSRF_TOKEN'``.
 
+CSRF_TRUSTED_ORIGINS
+----------------
+
+.. versionadded:: 1.9
+
+Default: ``[]``
+
+An iterable containing domains which will be included as part of the referer checks during CSRF processing of secure requests.
+
 .. setting:: DATABASES
 
 DATABASES

tests/csrf_tests/tests.py

@@ -352 +352 @@
         req2 = CsrfViewMiddleware().process_view(req, post_form_view, (), {})
         self.assertIsNone(req2)
 
+    @override_settings(ALLOWED_HOSTS=['www.example.com'], CSRF_TRUSTED_ORIGINS=['dashboard.example.com'])
+    def test_https_csrf_trusted_origin_allowed(self):
+        """
+        Test that a POST HTTPS request with a referer added to the
+        CSRF_TRUSTED_ORIGINS setting is accepted
+        """
+        # See ticket #24496
+        req = self._get_POST_request_with_token()
+        req._is_secure_override = True
+        req.META['HTTP_HOST'] = 'www.example.com'
+        req.META['HTTP_REFERER'] = 'https://dashboard.example.com'
+        req2 = CsrfViewMiddleware().process_view(req, post_form_view, (), {})
+        self.assertIsNone(req2)
+
     def test_ensures_csrf_cookie_no_middleware(self):
         """
         Tests that ensures_csrf_cookie decorator fulfils its promise