[Django] #28741: CSRF_COOKIE_DOMAIN / SESSION_COOKIE_DOMAIN are always cross domain
Django
----------------------------------------------+------------------------
Reporter: Niels van Huijstee | Owner: nobody
Type: Bug | Status: new
Component: Documentation | Version: 1.11
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
----------------------------------------------+------------------------
When I set CSRF_COOKIE_DOMAIN / SESSION_COOKIE_DOMAIN to a domain, like
"example.com", (no leading dot), the cookies are set to ".example.com"
(with leading dot). To me, this is not clear from the docs, so this is
either an undocumented feature or unintended behavior.
--
Ticket URL: <https://code.djangoproject.com/ticket/28741>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
Django
--------------------------------------+------------------------------------
Reporter: Niels van Huijstee | Owner: nobody
Component: Documentation | Version: 1.11
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
Changes (by Tim Graham):
* has_patch: 0 => 1
* type: Bug => Cleanup/optimization
* stage: Unreviewed => Accepted
Comment:
From [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-
Cookie#Invalid_domains Mozilla's documentation] for the `Set-Cookie`
header: "Contrary to earlier specifications, leading dots in domain names
are ignored. If a domain is specified, subdomains are always included."
[https://github.com/django/django/pull/9288 PR]
--
Ticket URL: <https://code.djangoproject.com/ticket/28741#comment:1>
Django
--------------------------------------+------------------------------------
Component: Documentation | Version: 1.11
Severity: Normal | Resolution: fixed
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
Changes (by GitHub <noreply@…>):
* status: new => closed
* resolution: => fixed
Comment:
In [changeset:"afd375fc343baa46e61036087bc43b3d096bb0ca" afd375f]:
{{{
#!CommitTicketReference repository=""
revision="afd375fc343baa46e61036087bc43b3d096bb0ca"
Fixed #28741 -- Removed unnecessary leading dot from cross-domain cookie
examples.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/28741#comment:2>
Django
--------------------------------------+------------------------------------
Component: Documentation | Version: 1.11
Severity: Normal | Resolution: fixed
Keywords: | Triage Stage: Accepted
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
Comment (by Tim Graham <timograham@…>):
In [changeset:"cd37e470962e544f60493d2a2c5f3a76c945a7e6" cd37e47]:
{{{
#!CommitTicketReference repository=""
revision="cd37e470962e544f60493d2a2c5f3a76c945a7e6"
[2.0.x] Fixed #28741 -- Removed unnecessary leading dot from cross-domain
cookie examples.
Backport of afd375fc343baa46e61036087bc43b3d096bb0ca from master
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/28741#comment:3>
Django
--------------------------------------+------------------------------------
Component: Documentation | Version: 1.11
Severity: Normal | Resolution: fixed
Keywords: | Triage Stage: Accepted
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
Comment (by Tim Graham):
It turns out that some of these leading dots are necessary for CSRF
protection (see #32065 and [https://github.com/django/django/pull/13830
PR]).
--
Ticket URL: <https://code.djangoproject.com/ticket/28741#comment:4>
Django
--------------------------------------+------------------------------------
Component: Documentation | Version: 1.11
Severity: Normal | Resolution: fixed
Keywords: | Triage Stage: Accepted
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
Comment (by Mariusz Felisiak <felisiak.mariusz@…>):
In [changeset:"2e7ba6057cfc82a15a22b6021cd60cf307152e2d" 2e7ba605]:
{{{
#!CommitTicketReference repository=""
revision="2e7ba6057cfc82a15a22b6021cd60cf307152e2d"
Refs #28741 -- Doc'd SESSION_COOKIE_DOMAIN requirement with
CSRF_USE_SESSIONS.
Similar considerations as refs #32065, again adding some nuance to
afd375fc343baa46e61036087bc43b3d096bb0ca.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/28741#comment:5>
Django
--------------------------------------+------------------------------------
Component: Documentation | Version: 1.11
Severity: Normal | Resolution: fixed
Keywords: | Triage Stage: Accepted
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
Comment (by Mariusz Felisiak <felisiak.mariusz@…>):
In [changeset:"f4db2d16ec42922078ff1951cd696c9b49e1e2f6" f4db2d1]:
{{{
#!CommitTicketReference repository=""
revision="f4db2d16ec42922078ff1951cd696c9b49e1e2f6"
[3.1.x] Refs #28741 -- Doc'd SESSION_COOKIE_DOMAIN requirement with
CSRF_USE_SESSIONS.
Similar considerations as refs #32065, again adding some nuance to
afd375fc343baa46e61036087bc43b3d096bb0ca.
Backport of 2e7ba6057cfc82a15a22b6021cd60cf307152e2d from master
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/28741#comment:6>