Verifies that the ``_xsrf`` cookie matches the ``_xsrf`` argument. To prevent cross-site request forgery, we set an ``_xsrf`` cookie and include the same value as a non-cookie field with all ``POST`` requests. If the two do not match, we reject the form submission as
(self)
| 1492 | return None, None, None |
| 1493 | |
| 1494 | def check_xsrf_cookie(self) -> None: |
| 1495 | """Verifies that the ``_xsrf`` cookie matches the ``_xsrf`` argument. |
| 1496 | |
| 1497 | To prevent cross-site request forgery, we set an ``_xsrf`` |
| 1498 | cookie and include the same value as a non-cookie |
| 1499 | field with all ``POST`` requests. If the two do not match, we |
| 1500 | reject the form submission as a potential forgery. |
| 1501 | |
| 1502 | The ``_xsrf`` value may be set as either a form field named ``_xsrf`` |
| 1503 | or in a custom HTTP header named ``X-XSRFToken`` or ``X-CSRFToken`` |
| 1504 | (the latter is accepted for compatibility with Django). |
| 1505 | |
| 1506 | See http://en.wikipedia.org/wiki/Cross-site_request_forgery |
| 1507 | |
| 1508 | .. versionchanged:: 3.2.2 |
| 1509 | Added support for cookie version 2. Both versions 1 and 2 are |
| 1510 | supported. |
| 1511 | """ |
| 1512 | # Prior to release 1.1.1, this check was ignored if the HTTP header |
| 1513 | # ``X-Requested-With: XMLHTTPRequest`` was present. This exception |
| 1514 | # has been shown to be insecure and has been removed. For more |
| 1515 | # information please see |
| 1516 | # http://www.djangoproject.com/weblog/2011/feb/08/security/ |
| 1517 | # http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails |
| 1518 | token = ( |
| 1519 | self.get_argument("_xsrf", None) |
| 1520 | or self.request.headers.get("X-Xsrftoken") |
| 1521 | or self.request.headers.get("X-Csrftoken") |
| 1522 | ) |
| 1523 | if not token: |
| 1524 | raise HTTPError(403, "'_xsrf' argument missing from POST") |
| 1525 | _, token, _ = self._decode_xsrf_token(token) |
| 1526 | _, expected_token, _ = self._get_raw_xsrf_token() |
| 1527 | if not token: |
| 1528 | raise HTTPError(403, "'_xsrf' argument has invalid format") |
| 1529 | if not hmac.compare_digest(utf8(token), utf8(expected_token)): |
| 1530 | raise HTTPError(403, "XSRF cookie does not match POST argument") |
| 1531 | |
| 1532 | def xsrf_form_html(self) -> str: |
| 1533 | """An HTML ``<input/>`` element to be included with all POST forms. |
no test coverage detected