mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-11-07 07:15:35 +00:00
Code Issues 32 Releases Wiki Activity

Fixed #25334 -- Provided a way to allow cross-origin unsafe requests over HTTPS.

Browse Source 
Added the CSRF_TRUSTED_ORIGINS setting which contains a list of other
domains that are included during the CSRF Referer header verification
for secure (HTTPS) requests.
This commit is contained in:
Joshua Kehn
2015-08-31 22:32:03 -04:00
committed by Tim Graham
parent 48c420d992
commit ab26b65b2f
7 changed files with 48 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
docs/releases/1.9.txt
View File

@@ -484,6 +484,9 @@ CSRF
* The request header's name used for CSRF authentication can be customized
with :setting:`CSRF_HEADER_NAME`.
* The new :setting:`CSRF_TRUSTED_ORIGINS` setting provides a way to allow
cross-origin unsafe requests (e.g. ``POST``) over HTTPS.
Signals
^^^^^^^