py_tasks_melange: app/django/contrib/csrf/middleware.py@b8b4a83788d4 (annotated)

54 03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	1	"""
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	2	Cross Site Request Forgery Middleware.
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	3
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	4	This module provides a middleware that implements protection
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	5	against request forgeries from other sites.
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	6
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	7	"""
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	8	from django.conf import settings
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	9	from django.http import HttpResponseForbidden
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	10	from django.utils.safestring import mark_safe
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	11	import md5
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	12	import re
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	13	import itertools
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	14
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	15	_ERROR_MSG = mark_safe('<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><body><h1>403 Forbidden</h1><p>Cross Site Request Forgery detected. Request aborted.</p></body></html>')
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	16
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	17	_POST_FORM_RE = \
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	18	re.compile(r'(<form\W[^>]\bmethod=(\'\|"\|)POST(\'\|"\|)\b[^>]>)', re.IGNORECASE)
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	19
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	20	_HTML_TYPES = ('text/html', 'application/xhtml+xml')
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	21
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	22	def _make_token(session_id):
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	23	return md5.new(settings.SECRET_KEY + session_id).hexdigest()
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	24
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	25	class CsrfMiddleware(object):
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	26	"""Django middleware that adds protection against Cross Site
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	27	Request Forgeries by adding hidden form fields to POST forms and
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	28	checking requests for the correct value.
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	29
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	30	In the list of middlewares, SessionMiddleware is required, and must come
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	31	after this middleware. CsrfMiddleWare must come after compression
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	32	middleware.
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	33
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	34	If a session ID cookie is present, it is hashed with the SECRET_KEY
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	35	setting to create an authentication token. This token is added to all
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	36	outgoing POST forms and is expected on all incoming POST requests that
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	37	have a session ID cookie.
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	38
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	39	If you are setting cookies directly, instead of using Django's session
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	40	framework, this middleware will not work.
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	41	"""
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	42
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	43	def process_request(self, request):
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	44	if request.method == 'POST':
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	45	try:
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	46	session_id = request.COOKIES[settings.SESSION_COOKIE_NAME]
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	47	except KeyError:
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	48	# No session, no check required
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	49	return None
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	50
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	51	csrf_token = _make_token(session_id)
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	52	# check incoming token
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	53	try:
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	54	request_csrf_token = request.POST['csrfmiddlewaretoken']
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	55	except KeyError:
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	56	return HttpResponseForbidden(_ERROR_MSG)
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	57
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	58	if request_csrf_token != csrf_token:
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	59	return HttpResponseForbidden(_ERROR_MSG)
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	60
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	61	return None
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	62
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	63	def process_response(self, request, response):
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	64	csrf_token = None
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	65	try:
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	66	cookie = response.cookies[settings.SESSION_COOKIE_NAME]
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	67	csrf_token = _make_token(cookie.value)
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	68	except KeyError:
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	69	# No outgoing cookie to set session, but
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	70	# a session might already exist.
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	71	try:
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	72	session_id = request.COOKIES[settings.SESSION_COOKIE_NAME]
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	73	csrf_token = _make_token(session_id)
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	74	except KeyError:
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	75	# no incoming or outgoing cookie
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	76	pass
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	77
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	78	if csrf_token is not None and \
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	79	response['Content-Type'].split(';')[0] in _HTML_TYPES:
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	80
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	81	# ensure we don't add the 'id' attribute twice (HTML validity)
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	82	idattributes = itertools.chain(("id='csrfmiddlewaretoken'",),
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	83	itertools.repeat(''))
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	84	def add_csrf_field(match):
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	85	"""Returns the matched <form> tag plus the added <input> element"""
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	86	return mark_safe(match.group() + "<div style='display:none;'>" + \
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	87	"<input type='hidden' " + idattributes.next() + \
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	88	" name='csrfmiddlewaretoken' value='" + csrf_token + \
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	89	"' /></div>")
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	90
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	91	# Modify any POST forms
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	92	response.content = _POST_FORM_RE.sub(add_csrf_field, response.content)
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	93	return response

author	Todd Larsen <tlarsen@google.com>
	Thu, 25 Sep 2008 17:17:11 +0000
changeset 202	b8b4a83788d4
parent 54	03e267d67478
child 323	ff1a9aa48cfd
permissions	-rw-r--r--