Re: CSRF problem (403 FORBIDDEN)

2014-03-17 22:15 GMT+07:00 Sergiy Khohlov <skhohlov@gmail.com>:

I'm proposing to update your views and templates for supporting csrf....
Many thanks,

Serge


+380 636150445
skype: skhohlov

On Mon, Mar 17, 2014 at 5:05 PM, Gkpetrak <gkpetrak@gmail.com> wrote:
> Hello,
>
> I'm developing an app using django and Openlayers javascript code. When I'm
> trying to post something via openlayers javascript code, it raises a 403
> FORBIDDEN ERROR.
> I don't use a form in my html file, the post applied by openlayers code. It
> runs successfully, only if I remove the
> 'django.middleware.csrf.CsrfViewMiddleware' from my settings.py.
> How can I fix it ?
> And how unprotected I am, without the
> 'django.middleware.csrf.CsrfViewMiddleware' in my settings.py ?
>
> Thank you in advance,
> George
>
>
> --
> You received this message because you are subscribed to the Google Groups
> "Django users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to django-users+unsubscribe@googlegroups.com.
> To post to this group, send email to django-users@googlegroups.com.
> Visit this group at http://groups.google.com/group/django-users.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/django-users/06b5902c-9281-4aa1-9736-dbf2e1c98e1b%40googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To post to this group, send email to django-users@googlegroups.com.
Visit this group at http://groups.google.com/group/django-users.

To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/CADTRxJM3v6%2BfdSrA_%3DoEzzA%2ByRjLJsUCU9bzx2jxE5HoK-hAPA%40mail.gmail.com.

For more options, visit https://groups.google.com/d/optout.

I agree with Sergiy, you should update your code to use CSRF tokens. It's not that hard to implement. When django creates a form, you will get a csrf-token as a hidden form parameter, just send that in the form you are updating.

What you risk running without CSRF tokens are man-in-the-middle attacks. Check http://en.wikipedia.org/wiki/Cross-site_request_forgery for more information.

Regards,

Andréas

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To post to this group, send email to django-users@googlegroups.com.
Visit this group at http://groups.google.com/group/django-users.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/CALXYUbn2Sy260eid6sR3THAa%2BLM9snCG%2B0qJOgyPGt067A3FBg%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.