diff options
| author | Michael Merickel <mmerickel@users.noreply.github.com> | 2016-04-16 15:17:52 -0500 |
|---|---|---|
| committer | Michael Merickel <mmerickel@users.noreply.github.com> | 2016-04-16 15:17:52 -0500 |
| commit | 4a4d4b90d108f545000666080b873363386d3ac9 (patch) | |
| tree | 6185b4704a6de2261d5568773c260d50e209d0aa /docs/narr/sessions.rst | |
| parent | 1799be9dd8666d10d6b4a04a9b75fc57f8626c6f (diff) | |
| parent | 65dee6e4ca0c0c607e97db0c9e55768f10591a58 (diff) | |
| download | pyramid-4a4d4b90d108f545000666080b873363386d3ac9.tar.gz pyramid-4a4d4b90d108f545000666080b873363386d3ac9.tar.bz2 pyramid-4a4d4b90d108f545000666080b873363386d3ac9.zip | |
Merge pull request #2501 from dstufft/check-origin-csrf
In addition to CSRF token, verify the origin too
Diffstat (limited to 'docs/narr/sessions.rst')
| -rw-r--r-- | docs/narr/sessions.rst | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/docs/narr/sessions.rst b/docs/narr/sessions.rst index 0e895ff81..7cf96ac7d 100644 --- a/docs/narr/sessions.rst +++ b/docs/narr/sessions.rst @@ -437,6 +437,14 @@ It is always possible to pass the token in the ``X-CSRF-Token`` header as well. There is currently no way to define an alternate name for this header without performing CSRF checking manually. +In addition to token based CSRF checks, the automatic CSRF checking will also +check the referrer of the request to ensure that it matches one of the trusted +origins. By default the only trusted origin is the current host, however +additional origins may be configured by setting +``pyramid.csrf_trusted_origins`` to a list of domain names (and ports if they +are non standard). If a host in the list of domains starts with a ``.`` then +that will allow all subdomains as well as the domain without the ``.``. + If CSRF checks fail then a :class:`pyramid.exceptions.BadCSRFToken` exception will be raised. This exception may be caught and handled by an :term:`exception view` but, by default, will result in a ``400 Bad Request`` |