Friday, September 25, 2015

Re: NOOB exposes CSRF token. Now what?

On Fri, Sep 25, 2015 at 7:03 AM, Gordon Reeder <> wrote:
> I'm learning Django and still very new at it. And like a newbie, I may have
> made a newbie goof.
> I have leaked my CSRF token.
> I am building up a web site with Django which I have under revision control
> with Git. I have pushed two commits of the project out to Github. The
> commits included the file, which list the CSRF token. I have
> read (after the fact) that maybe that wasn't the smartest thing to do.
> So now what?
> Can I remove the file from Github?
> Or can I generate a new CSRF token?
> Any suggestions?

CSRF tokens are generated on the fly, they aren't stored in your

However, what is stored in settings is your SECRET_KEY. If you have
leaked it, you should change it immediately. This will invalidate
sessions, signed cookies, password reset tokens, some forms (if loaded
before you change it, and submitted after).

Take the pain now.



You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to
To post to this group, send email to
Visit this group at
To view this discussion on the web visit
For more options, visit

No comments:

Post a Comment