[Django] #17157: CSRF fails in cross-domain iframes on IE
Django
-------------------------------+----------------------------
Reporter: akaihola | Owner: nobody
Type: New feature | Status: new
Component: Documentation | Version: SVN
Severity: Normal | Keywords: csrf iframe ie
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 1 | UI/UX: 0
-------------------------------+----------------------------
Internet Explorer >=6
[http://en.wikipedia.org/wiki/HTTP_cookie#Browser_settings blocks third-
party cookies by default].
This [http://bitkickers.blogspot.com/2011/06/django-csrf-verification-
failed-in-ie.html causes CSRF to fail]
for forms which are in iframes which come from a different domain. The
user gets this message:
{{{
Forbidden (403)
CSRF verification failed. Request aborted.
}}}
When a developer hits this problem,
[http://stackoverflow.com/questions/7441889/#7991359 possible solutions]
are
* not use an iframe
* bring the iframed page under the same domain as the main page
* use the [https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#edge-
cases @csrf_exempt]
decorator for the form
* add HTTP headers to tell the browser to allow third-party cookies (see
[http://bitkickers.blogspot.com/2011/06/django-csrf-verification-failed-
in-ie.html Chase Seibert's work around #3])
None of the solutions can be made for the developer by Django,
so the best Django can do is to provide a note about this corner case in
the
[https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#scenarios
Scenarios section of the CSRF documentation].
--
Ticket URL: <https://code.djangoproject.com/ticket/17157>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
Django
Type: New feature | Status: new
Component: Documentation | Version: SVN
Keywords: csrf iframe ie | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Changes (by lukeplant):
* needs_better_patch: => 0
* stage: Unreviewed => Accepted
* needs_tests: => 0
* needs_docs: => 0
--
Ticket URL: <https://code.djangoproject.com/ticket/17157#comment:1>
Django
Reporter: akaihola | Owner: susan
Type: New feature | Status: assigned
Component: Documentation | Version: master
Severity: Normal | Resolution:
Keywords: csrf iframe ie | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Easy pickings: 1 | UI/UX: 0
Changes (by susan):
* owner: nobody => susan
* status: new => assigned
--
Ticket URL: <https://code.djangoproject.com/ticket/17157#comment:2>
Django
Reporter: akaihola | Owner: susan
Type: New feature | Status: assigned
Component: Documentation | Version: master
Severity: Normal | Resolution:
Keywords: csrf iframe ie | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Easy pickings: 1 | UI/UX: 0
Comment (by jedierikb@…):
A few questions about this and the proposed workarounds.
1. Could you elaborate ''bring the iframed page under the same domain as
the main page''? When using a javascript library like jQuery File Upload
[https://github.com/blueimp/jQuery-File-Upload], their javascript
dynamically creates an iFrame with a form. How could the use of the
library or the library itself be adjusted so as to avoid the problems
described in this bug? Does it matter if the library is loaded from
another site hosted elsewhere?
2. Can you pass CSRF credentials as URL parameters? This is suggested by
the author of the jQuery File Upload library here
[https://github.com/blueimp/jQuery-File-
Upload/pull/148#issuecomment-4251262]. What are the concerns, precautions
to take when doing this?
--
Ticket URL: <https://code.djangoproject.com/ticket/17157#comment:3>
Django
Reporter: akaihola | Owner: susan
Type: New feature | Status: assigned
Component: Documentation | Version: master
Severity: Normal | Resolution:
Keywords: csrf iframe ie | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Easy pickings: 1 | UI/UX: 0
Comment (by akaihola):
Unfortunately I can't recall details of the upload functionality I was
implementing when I created this ticket. I would assume that I wasn't
using any JavaScript library but made a plain HTML form inside an iframe.
In this case a straightforward solution would have been getting rid of the
requirement of serving the iframe contents from a separate subdomain.
That's what I probably meant by "bring the iframed page..".
CSRF in query parameters would probably work. I don't seem to have thought
of it back then.
--
Ticket URL: <https://code.djangoproject.com/ticket/17157#comment:4>
Django
Reporter: akaihola | Owner:
Type: New feature | Status: new
Severity: Normal | Resolution:
Keywords: csrf iframe ie | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Easy pickings: 1 | UI/UX: 0
Changes (by anonymous):
* owner: susan =>
* status: assigned => new
--
Ticket URL: <https://code.djangoproject.com/ticket/17157#comment:5>
Django
Reporter: akaihola | Owner:
Type: New feature | Status: new
Severity: Normal | Resolution:
Keywords: csrf iframe ie | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
--------------------------------+------------------------------------
Changes (by timo):
* easy: 1 => 0
--
Ticket URL: <https://code.djangoproject.com/ticket/17157#comment:6>
Django
Reporter: akaihola | Owner: joshkehn
Type: New feature | Status: assigned
Severity: Normal | Resolution:
Keywords: csrf iframe ie | Triage Stage: Accepted
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------+------------------------------------
* owner: => joshkehn
* needs_docs: 0 => 1
* status: new => assigned
Comment:
Will be adding documentation specific to IE >=6 and `iframes`.
--
Ticket URL: <https://code.djangoproject.com/ticket/17157#comment:7>
Django
Reporter: akaihola | Owner:
Type: New feature | Status: new
Severity: Normal | Resolution:
Keywords: csrf iframe ie | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 1
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------+------------------------------------
Changes (by joshkehn):
* owner: joshkehn =>
* status: assigned => new
--
Ticket URL: <https://code.djangoproject.com/ticket/17157#comment:8>
Django
Reporter: Antti Kaihola | Owner: Lukas Udstuen
Type: New feature | Status: assigned
Severity: Normal | Resolution:
Keywords: csrf iframe ie | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 1
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
Changes (by Lukas Udstuen):
* owner: (none) => Lukas Udstuen
* status: new => assigned
--
Ticket URL: <https://code.djangoproject.com/ticket/17157#comment:9>
Django
Reporter: Antti Kaihola | Owner: (none)
Type: New feature | Status: new
Severity: Normal | Resolution:
Keywords: csrf iframe ie | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 1
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------+------------------------------------
* owner: Lukas Udstuen => (none)
* status: assigned => new
--
Ticket URL: <https://code.djangoproject.com/ticket/17157#comment:10>
Django
Reporter: Antti Kaihola | Owner: (none)
Component: Documentation | Version: master
Severity: Normal | Resolution: wontfix
Keywords: csrf iframe ie | Triage Stage: Unreviewed
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
Changes (by felixxm):
* status: new => closed
* needs_docs: 1 => 0
* resolution: => wontfix
* stage: Accepted => Unreviewed
Comment:
Microsoft deprecated all versions of Internet Explorer (see related
#31032) hence we'll not describe any new IE workarounds/caveats in Django
docs.
--
Ticket URL: <https://code.djangoproject.com/ticket/17157#comment:11>