django.middleware.csrf

module documentation

Cross Site Request Forgery Middleware.

This module provides a middleware that implements protection against request forgeries from other sites.

Class ​Csrf​View​Middleware Require a present and correct csrfmiddlewaretoken for POST requests that have a CSRF cookie, and set an outgoing CSRF cookie.
Constant CSRF​_ALLOWED​_CHARS Undocumented
Constant CSRF​_SECRET​_LENGTH Undocumented
Constant CSRF​_SESSION​_KEY Undocumented
Constant CSRF​_TOKEN​_LENGTH Undocumented
Constant REASON​_BAD​_ORIGIN Undocumented
Constant REASON​_BAD​_REFERER Undocumented
Constant REASON​_CSRF​_TOKEN​_MISSING Undocumented
Constant REASON​_INCORRECT​_LENGTH Undocumented
Constant REASON​_INSECURE​_REFERER Undocumented
Constant REASON​_INVALID​_CHARACTERS Undocumented
Constant REASON​_MALFORMED​_REFERER Undocumented
Constant REASON​_NO​_CSRF​_COOKIE Undocumented
Constant REASON​_NO​_REFERER Undocumented
Variable invalid​_token​_chars​_re Undocumented
Variable logger Undocumented
Class ​Invalid​Token​Format Undocumented
Class ​Reject​Request Undocumented
Function ​_add​_new​_csrf​_cookie Generate a new random CSRF_COOKIE value, and add it to request.META.
Function ​_does​_token​_match Undocumented
Function ​_get​_failure​_view Return the view to be used for CSRF rejections.
Function ​_get​_new​_csrf​_string Undocumented
Function ​_mask​_cipher​_secret Given a secret (assumed to be a string of CSRF_ALLOWED_CHARS), generate a token by adding a mask and applying it to the secret.
Function ​_sanitize​_token Undocumented
Function ​_unmask​_cipher​_token Given a token (assumed to be a string of CSRF_ALLOWED_CHARS, of length CSRF_TOKEN_LENGTH, and that its first half is a mask), use it to decrypt the second half to produce the original secret.
Function get​_token Return the CSRF token required for a POST form. The token is an alphanumeric value. A new token is created if one is not already set.
Function rotate​_token Change the CSRF token in use for a request - should be done on login for security purposes.
CSRF_ALLOWED_CHARS =

Undocumented

Value
string.ascii_letters+string.digits
CSRF_SECRET_LENGTH: int =

Undocumented

Value
32
CSRF_SESSION_KEY: str =

Undocumented

Value
'_csrftoken'
CSRF_TOKEN_LENGTH =

Undocumented

Value
2*CSRF_SECRET_LENGTH
REASON_BAD_ORIGIN: str =

Undocumented

Value
'Origin checking failed - %s does not match any trusted origins.'
REASON_BAD_REFERER: str =

Undocumented

Value
'Referer checking failed - %s does not match any trusted origins.'
REASON_CSRF_TOKEN_MISSING: str =

Undocumented

Value
'CSRF token missing.'
REASON_INCORRECT_LENGTH: str =

Undocumented

Value
'has incorrect length'
REASON_INSECURE_REFERER: str =

Undocumented

Value
'Referer checking failed - Referer is insecure while host is secure.'
REASON_INVALID_CHARACTERS: str =

Undocumented

Value
'has invalid characters'
REASON_MALFORMED_REFERER: str =

Undocumented

Value
'Referer checking failed - Referer is malformed.'
REASON_NO_CSRF_COOKIE: str =

Undocumented

Value
'CSRF cookie not set.'
REASON_NO_REFERER: str =

Undocumented

Value
'Referer checking failed - no Referer.'
invalid_token_chars_re =

Undocumented

logger =

Undocumented

def _add_new_csrf_cookie(request):
Generate a new random CSRF_COOKIE value, and add it to request.META.
def _does_token_match(request_csrf_token, csrf_token):

Undocumented

def _get_failure_view():
Return the view to be used for CSRF rejections.
def _get_new_csrf_string():

Undocumented

def _mask_cipher_secret(secret):
Given a secret (assumed to be a string of CSRF_ALLOWED_CHARS), generate a token by adding a mask and applying it to the secret.
def _sanitize_token(token):

Undocumented

def _unmask_cipher_token(token):
Given a token (assumed to be a string of CSRF_ALLOWED_CHARS, of length CSRF_TOKEN_LENGTH, and that its first half is a mask), use it to decrypt the second half to produce the original secret.
def get_token(request):

Return the CSRF token required for a POST form. The token is an alphanumeric value. A new token is created if one is not already set.

A side effect of calling this function is to make the csrf_protect decorator and the CsrfViewMiddleware add a CSRF cookie and a 'Vary: Cookie' header to the outgoing response. For this reason, you may need to use this function lazily, as is done by the csrf context processor.

def rotate_token(request):
Change the CSRF token in use for a request - should be done on login for security purposes.