4 ms·

Secret key is used for signing. https://github.com/django/django/blob/master/django/core/signing.py#L156 https://github.com/django/django/blob/master/django/cor

• abeyer 10y ago
  Unfortunately the csrf implementation doesn't use that. (At least not in the absence of a session store.) It "encrypts" the random token by adding a random salt to it, but has no way of validating that after generation. When a csrf protected request is made the token in the cookie is compared to the token in the POST data, but not validated in any other way. https://github.com/django/django/blob/master/django/middleware/csrf.py#L50 https://github.com/django/django/blob/master/django/middlewa... I wonder how much of this is just a political issue about the core/contrib division and the fact that csrf is in core while sessions is in contrib. It seems to me that the "right" fix is to make csrf protection require a session store, and move (at least) the signed cookie session support into core. Edit: Actually it looks like cookie signing is already implemented in core, so now I'm really unsure why csrf isn't using that already.
  • berdario 10y ago
    Yeah, weird... I guess that since sessions are enabled by default, they didn't bother making it independent/explicitly requiring it