Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

Added clarifying note to docs for CSRF_COOKIE_DOMAIN

git-svn-id: http://code.djangoproject.com/svn/django/trunk@16197 bcc190cf-cafb-0310-a4f2-bffc1f526a37
  • Loading branch information...
commit bf7af2be15a0844f5c1ae9a47cb75fc255e0eaf6 1 parent 8122ce7
@spookylukey spookylukey authored
Showing with 8 additions and 2 deletions.
  1. +2 −0  docs/ref/contrib/csrf.txt
  2. +6 −2 docs/ref/settings.txt
View
2  docs/ref/contrib/csrf.txt
@@ -280,6 +280,8 @@ CSRF checks::
>>> from django.test import Client
>>> csrf_client = Client(enforce_csrf_checks=True)
+.. _csrf-limitations:
+
Limitations
===========
View
8 docs/ref/settings.txt
@@ -319,11 +319,15 @@ CSRF_COOKIE_DOMAIN
Default: ``None``
The domain to be used when setting the CSRF cookie. This can be useful for
-allowing cross-subdomain requests to be exluded from the normal cross site
-request forgery protection. It should be set to a string such as
+easily allowing cross-subdomain requests to be exluded from the normal cross
+site request forgery protection. It should be set to a string such as
``".lawrence.com"`` to allow a POST request from a form on one subdomain to be
accepted by accepted by a view served from another subdomain.
+Please note that the presence of this setting does not imply that Django's CSRF
+protection is safe from cross-subdomain attacks by default - please see the
+:ref:`CSRF limitations <csrf-limitations>` section.
+
.. setting:: CSRF_COOKIE_NAME
CSRF_COOKIE_NAME
Please sign in to comment.
Something went wrong with that request. Please try again.