search

pennersr / django-allauth

Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication.
https://allauth.org
MIT License
9.54k stars 3.03k forks source link

csrf issue #3957

Closed davidu1975 closed 4 months ago

davidu1975 commented 4 months ago

Enabling CSRF protection in our Django app causes the value self.request.session[INTERNAL_RESET_SESSION_KEY] is "lost"

PasswordResetFromKeyView.dispatch method is entered twice first time self.request.session[INTERNAL_RESET_SESSION_KEY] = self.key is run

second time self.key = self.request.session.get(INTERNAL_RESET_SESSION_KEY, "") has no value form is invalid and Bad Token is displayed

pennersr commented 4 months ago

Can you reproduce the issue e.g. using the demo over at https://django.demo.allauth.org/ ? If not, what are the differences in what you are doing compared to the example app? Again, this issue is not actionable on this side.