Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

Slight change to CSRF error messages to make debugging easier.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@11669 bcc190cf-cafb-0310-a4f2-bffc1f526a37
  • Loading branch information...
commit d0b900e6f52e3d16d32ae42a1f80ee61b256db18 1 parent b32a187
@spookylukey spookylukey authored
Showing with 6 additions and 2 deletions.
  1. +6 −2 django/middleware/csrf.py
View
8 django/middleware/csrf.py
@@ -145,14 +145,18 @@ def accept():
# No CSRF cookie and no session cookie. For POST requests,
# we insist on a CSRF cookie, and in this way we can avoid
# all CSRF attacks, including login CSRF.
- return reject("No CSRF cookie.")
+ return reject("No CSRF or session cookie.")
else:
csrf_token = request.META["CSRF_COOKIE"]
# check incoming token
request_csrf_token = request.POST.get('csrfmiddlewaretoken', None)
if request_csrf_token != csrf_token:
- return reject("CSRF token missing or incorrect.")
+ if cookie_is_new:
+ # probably a problem setting the CSRF cookie
+ return reject("CSRF cookie not set.")
+ else:
+ return reject("CSRF token missing or incorrect.")
return accept()
Please sign in to comment.
Something went wrong with that request. Please try again.