Check CSRF Referer against CSRF_TRUSTED_ORIGINS

[Matt Robenolt]

Right now, if you try to share a CSRF token across a subdomain without https, everything works great since the Referer header isn't validated.

But over https, we want to be a bit more strict and make sure that the Referer is from another secure site, and also that the Referer matches where we think it should be coming from. Django should validate that the Referer header matches one of the domains listed in CSRF_TRUSTED_ORIGINS, including the currently responding ALLOWED_HOST.

[Tim Graham]

Could you provide a reference for "we want to be a bit more strict ..."? For example, is this part of an RFC or something that other frameworks implement?

[Matt Robenolt]

I think the comment in this file explains it best:

# Suppose user visits http://example.com/
# An active network attacker (man-in-the-middle, MITM) sends a
# POST form that targets https://example.com/detonate-bomb/ and
# submits it via JavaScript.
#
# The attacker will need to provide a CSRF cookie and token, but
# that's no problem for a MITM and the session-independent
# nonce we're using. So the MITM can circumvent the CSRF
# protection. This is true for any HTTP connection, but anyone
# using HTTPS expects better! For this reason, for
# https://example.com/ we need additional protection that treats
# http://example.com/ as completely untrusted. Under HTTPS,
# Barth et al. found that the Referer header is missing for
# same-domain requests in only about 0.2% of cases or less, so
# we can use strict Referer checking.

​https://github.com/django/django/blob/668d53cd125175eb708cc0af143f47b42cd42153/django/middleware/csrf.py#L135-L149

[Carl Meyer]

Tim, the "we want to be more strict" is something Django already implements (checking REFERER against the request host on an HTTPS request). Matt's feature request is for that check to be against CSRF_COOKIE_DOMAIN rather than the request host, to allow for cross-subdomain requests. I think this is reasonable, and probably the way it should have worked from the beginning.

[Matt Robenolt]

I've opened a discussion on the mailing list as suggested by timgraham since this is related to security: ​https://groups.google.com/forum/#!topic/django-developers/tEEw02RhV0M

[Aymeric Augustin]

Looks reasonable to me.

[Tim Graham]

Marking as "patch needs improvement" per Luke's comments.

[Seth Gottlieb]

Submitted a pull request to mattrobenolt that added some documentation for his fix.

If we decide to go with Troy Grosfield's suggestion of adding a CSRF_WHITELIST_ORIGINS setting (which I like), I can document that instead.

[Joshua Kehn]

Based on the mailing list discussion here ​https://groups.google.com/forum/#!topic/django-developers/eQeaNzSlSbw I'm updating the ticket description and including a PR with tests and updated documentation that allows expanding the allowed HTTP Referer domains via a setting called CSRF_TRUSTED_ORIGINS.

PR is open: ​https://github.com/django/django/pull/5218

A patch has been added to this ticket as well.