Opened 3 years ago
Last modified 3 years ago
#32817 closed Cleanup/optimization
Include in CsrfViewMiddleware's bad CSRF token message where the token is from — at Initial Version
| Reported by: | Chris Jerdonek | Owned by: | nobody |
|---|---|---|---|
| Component: | CSRF | Version: | dev |
| Severity: | Normal | Keywords: | |
| Cc: | Triage Stage: | Ready for checkin | |
| Has patch: | yes | Needs documentation: | no |
| Needs tests: | no | Patch needs improvement: | no |
| Easy pickings: | no | UI/UX: | no |
Description
Currently, if CsrfViewMiddleware encounters a bad CSRF token, it will reject the request with a message like--
- "CSRF token incorrect"
- "CSRF token has incorrect length"
I noticed that it would be relatively easy to include in these messages whether the token was obtained from POST data or a custom header, which would be useful for troubleshooting. The new messages could look e.g. like--
- "CSRF token (from POST) incorrect"
- "CSRF token (from 'X-CSRFToken' header) has incorrect length"
The changes to CsrfViewMiddlewareTestMixin proposed in #32800 would make these cases easy to test.
Note:
See TracTickets
for help on using tickets.