Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

Refs #15855 -- Recommended the csrf_protect decorator rather than var…

…y_on_cookie as workaround for cache_page caching the response before it gets to middleware.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@16361 bcc190cf-cafb-0310-a4f2-bffc1f526a37
  • Loading branch information...
commit 0e03a504bf28c727283bcabbff0f4dc63feaf573 1 parent 528157c
@carljm carljm authored
Showing with 6 additions and 5 deletions.
  1. +6 −5 docs/ref/contrib/csrf.txt
View
11 docs/ref/contrib/csrf.txt
@@ -238,15 +238,16 @@ middleware will play well with the cache middleware if it is used as instructed
(``UpdateCacheMiddleware`` goes before all other middleware).
However, if you use cache decorators on individual views, the CSRF middleware
-will not yet have been able to set the Vary header. In this case, on any views
-that will require a CSRF token to be inserted you should use the
-:func:`django.views.decorators.vary.vary_on_cookie` decorator first::
+will not yet have been able to set the Vary header or the CSRF cookie, and the
+response will be cached without either one. In this case, on any views that
+will require a CSRF token to be inserted you should use the
+:func:`django.views.decorators.csrf.csrf_protect` decorator first::
from django.views.decorators.cache import cache_page
- from django.views.decorators.vary import vary_on_cookie
+ from django.views.decorators.csrf import csrf_protect
@cache_page(60 * 15)
- @vary_on_cookie
+ @csrf_protect
def my_view(request):
# ...
Please sign in to comment.
Something went wrong with that request. Please try again.