[1.5.x] Fixed bug causing CSRF token not to rotate on login.

Thanks Gavin McQuillan for the report. Backport of ac4fec5 from master
django · Oct 18, 2013 · 0fb2897 · 0fb2897
1 parent 312ca5e
commit 0fb2897
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/django/contrib/auth/tests/views.py b/django/contrib/auth/tests/views.py
@@ -392,7 +392,6 @@ def test_login_csrf_rotate(self, password='password'):
         CsrfViewMiddleware().process_view(req, login_view, (), {})
         req.META["SERVER_NAME"] = "testserver"  # Required to have redirect work in login view
         req.META["SERVER_PORT"] = 80
-        req.META["CSRF_COOKIE_USED"] = True
         resp = login_view(req)
         resp2 = CsrfViewMiddleware().process_response(req, resp)
         csrf_cookie = resp2.cookies.get(settings.CSRF_COOKIE_NAME, None)

diff --git a/django/middleware/csrf.py b/django/middleware/csrf.py
@@ -58,7 +58,10 @@ def rotate_token(request):
     Changes the CSRF token in use for a request - should be done on login
     for security purposes.
     """
-    request.META["CSRF_COOKIE"] = _get_new_csrf_key()
+    request.META.update({
+        "CSRF_COOKIE_USED": True,
+        "CSRF_COOKIE": _get_new_csrf_key(),
+    })
 
 
 def _sanitize_token(token):