diff options
| author | Donald Stufft <donald@stufft.io> | 2016-04-15 20:42:20 -0400 |
|---|---|---|
| committer | Donald Stufft <donald@stufft.io> | 2016-04-16 16:00:45 -0400 |
| commit | 65dee6e4ca0c0c607e97db0c9e55768f10591a58 (patch) | |
| tree | 6185b4704a6de2261d5568773c260d50e209d0aa /docs/narr/sessions.rst | |
| parent | 1799be9dd8666d10d6b4a04a9b75fc57f8626c6f (diff) | |
| download | pyramid-65dee6e4ca0c0c607e97db0c9e55768f10591a58.tar.gz pyramid-65dee6e4ca0c0c607e97db0c9e55768f10591a58.tar.bz2 pyramid-65dee6e4ca0c0c607e97db0c9e55768f10591a58.zip | |
In addition to CSRF token, verify the origin too
Add an additional layer of protection against CSRF by verifying the actual
origin of the request in addition to the CSRF token. We only do this check on
sites hosted behind HTTPS because only HTTPS sites have evidence to show that
the Referrer header is not being spuriously removed by random middleware
boxes.
Diffstat (limited to 'docs/narr/sessions.rst')
| -rw-r--r-- | docs/narr/sessions.rst | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/docs/narr/sessions.rst b/docs/narr/sessions.rst index 0e895ff81..7cf96ac7d 100644 --- a/docs/narr/sessions.rst +++ b/docs/narr/sessions.rst @@ -437,6 +437,14 @@ It is always possible to pass the token in the ``X-CSRF-Token`` header as well. There is currently no way to define an alternate name for this header without performing CSRF checking manually. +In addition to token based CSRF checks, the automatic CSRF checking will also +check the referrer of the request to ensure that it matches one of the trusted +origins. By default the only trusted origin is the current host, however +additional origins may be configured by setting +``pyramid.csrf_trusted_origins`` to a list of domain names (and ports if they +are non standard). If a host in the list of domains starts with a ``.`` then +that will allow all subdomains as well as the domain without the ``.``. + If CSRF checks fail then a :class:`pyramid.exceptions.BadCSRFToken` exception will be raised. This exception may be caught and handled by an :term:`exception view` but, by default, will result in a ``400 Bad Request`` |