search

disqus / gargoyle

Feature switches in Django
http://engineering.disqus.com
Apache License 2.0
746 stars 112 forks source link

csrf errors #31

Open rizumu opened 12 years ago

rizumu commented 12 years ago

Tried installing gargoyle 0.6.1 with nexus 0.2.3 and none of the ajax links work for managing switches, due to the standard csrf errors. 403 forbidden CSRF verification failed. Request aborted.

The recent nexus commits to use ajaxSetup are being called correctly, but something (I've no idea what) is not working with gargoyles provided templates and staticfiles.

dcramer commented 12 years ago

Can you check the requests and see if it's showing the X-CSRF (or whatever its labeled) header in them? Also see if it's setting the csrf cookie on the initial gargoyle page load.

rizumu commented 12 years ago

The X-CSRFToken is set in the headers.

Django is setting the csrf cookie, however I am using a custom name: CSRF_COOKIE_NAME = "comunidad_csrftoken"

dcramer commented 12 years ago

And it's sending the token header (with the ajax call) as the correct value of the cookie? Are you behind SSL?

rizumu commented 12 years ago

hrmpf. Today the token header isn't being included so I can't check. No SSL atm, and I'm on localhost. Well, I'll revisit it next week.

armisael commented 11 years ago

Just to resurrect this issue: this happens when you set a custom CSRF_COOKIE_NAME.

In our websites we have the following configuration: default cookie name for production environment (csrftoken) and a custom value for staging and unstable environments (s_csrftoken and u_csrftoken respectively)

Gargoyle request:

Cookie:csrftoken=rm11CGoHiH4znZQ... u_csrftoken=Ychnso82YtOutx8ywmk...
X-CSRFToken:rm11CGoHiH4znZQ...

One of our (patched) requests:

Cookie:csrftoken=rm11CGoHiH4znZQ... u_csrftoken=Ychnso82YtOutx8ywmk...
X-CSRFToken:Ychnso82YtOutx8ywmk...

What we did is just to edit the code at https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#ajax replacing the CSRF cookie name in var csrftoken = getCookie('csrftoken');

Hope this issue will be fixed soon, gargoyle is an essential part of our infrastructure, and not being able to use it properly in our testing environment is kinda problematic.

martino commented 11 years ago

+1