Opened 3 years ago

Last modified 3 years ago

#32817 closed Cleanup/optimization

Include in CsrfViewMiddleware's bad CSRF token message where the token is from — at Version 1

Reported by: Chris Jerdonek Owned by: nobody
Component: CSRF Version: dev
Severity: Normal Keywords:
Cc: Triage Stage: Ready for checkin
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description (last modified by Chris Jerdonek)

Currently, if CsrfViewMiddleware encounters a bad CSRF token, it will reject the request with a message like--

  • "CSRF token incorrect"
  • "CSRF token has incorrect length"

I noticed that it would be relatively easy to include in these messages whether the token was obtained from POST data or a custom header, which would be useful for troubleshooting. The messages are specified ​here in the code. The new messages could look e.g. like--

  • "CSRF token (from POST) incorrect"
  • "CSRF token (from 'X-CSRFToken' header) has incorrect length"

The changes to CsrfViewMiddlewareTestMixin proposed in #32800 would make these cases easy to test.

Change History (1)

comment:1 by Chris Jerdonek, 3 years ago

Description: modified (diff)
Note: See TracTickets for help on using tickets.
Back to Top