diff options
| author | Donald Stufft <donald@stufft.io> | 2016-04-15 17:59:55 -0400 |
|---|---|---|
| committer | Donald Stufft <donald@stufft.io> | 2016-04-15 18:31:23 -0400 |
| commit | 21d5beaed1641e1f50ab1ab3c481b1c8f3ad1173 (patch) | |
| tree | 378c537494498bf517562e41baccb8ce43a8145b /docs/narr/viewconfig.rst | |
| parent | f12005b92fa9bb33f082bd50747eb11791605cff (diff) | |
| download | pyramid-21d5beaed1641e1f50ab1ab3c481b1c8f3ad1173.tar.gz pyramid-21d5beaed1641e1f50ab1ab3c481b1c8f3ad1173.tar.bz2 pyramid-21d5beaed1641e1f50ab1ab3c481b1c8f3ad1173.zip | |
Have Automatic CSRF on all unsafe HTTP methods
Instead of only protecting against unsafe POST requests, have the automatic
CSRF protect on all methods which are not defined as "safe" by RFC2616.
Diffstat (limited to 'docs/narr/viewconfig.rst')
| -rw-r--r-- | docs/narr/viewconfig.rst | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/docs/narr/viewconfig.rst b/docs/narr/viewconfig.rst index 40db5fbeb..3b8f0353a 100644 --- a/docs/narr/viewconfig.rst +++ b/docs/narr/viewconfig.rst @@ -195,10 +195,11 @@ Non-Predicate Arguments ``require_csrf`` - CSRF checks only affect POST requests. Any other request methods will pass - untouched. This option is used in combination with the - ``pyramid.require_default_csrf`` setting to control which request parameters - are checked for CSRF tokens. + CSRF checks will affect any request method that is not defined as a "safe" + method by RFC2616. In pratice this means that GET, HEAD, OPTIONS, and TRACE + methods will pass untouched and all others methods will require CSRF. This + option is used in combination with the ``pyramid.require_default_csrf`` + setting to control which request parameters are checked for CSRF tokens. This feature requires a configured :term:`session factory`. |