Re: CSRF token still needed today?

2020-04-21 Thread David Merrick
19 apr. 2020 kl 22:12 skrev guettli < >>> guettl...@thomas-guettler.de>: >>> >>>> iI look at this page: https://docs.djangoproject.com/en/3.0/ref/csrf/ >>>> ... and then I look at this page: >>>> https://scotthelme.co.uk/csrf-is-dead/ >>>>

Re: CSRF token still needed today?

2020-04-21 Thread Kenny Loveall
The original blog post you posted seems to answer this question. Further it states "It's going to be a long time until we can consider removing traditional anti-CSRF mechanisms but adding SameSite on top of those gives us an incredibly robust defence." Like most things in security, I think this is

Re: CSRF token still needed today?

2020-04-21 Thread guettli
Am Sonntag, 19. April 2020 23:11:59 UTC+2 schrieb Alex Heyden: > > Django supports samesite on session cookies now, and it's on (set to lax) > by default. Whether or not that completely covers your surface risk to CSRF > attacks is a somewhat different question. > > AFAIK they can not happen.

Re: CSRF token still needed today?

2020-04-21 Thread guettli
ject.com/en/3.0/ref/csrf/ >> ... and then I look at this page: https://scotthelme.co.uk/csrf-is-dead/ >> >> Is a CSRF token still needed today? >> >> All my users use a modern browser. >> >> It would be very nice if I could get rid of the CSRF token. >> >

Re: CSRF token still needed today?

2020-04-21 Thread guettli
t; >> >> Den sön 19 apr. 2020 kl 22:12 skrev guettli > >: >> >>> iI look at this page: https://docs.djangoproject.com/en/3.0/ref/csrf/ >>> ... and then I look at this page: https://scotthelme.co.uk/csrf-is-dead/ >>> >>> Is a CSRF tok

Re: CSRF token still needed today?

2020-04-20 Thread David Merrick
gards, > > Andréas > > > Den sön 19 apr. 2020 kl 22:12 skrev guettli < > guettli.goo...@thomas-guettler.de>: > >> iI look at this page: https://docs.djangoproject.com/en/3.0/ref/csrf/ >> ... and then I look at this page: https://scotthelme.co.uk/csrf-is-dea

Re: CSRF token still needed today?

2020-04-20 Thread Andréas Kühne
ge: https://docs.djangoproject.com/en/3.0/ref/csrf/ > ... and then I look at this page: https://scotthelme.co.uk/csrf-is-dead/ > > Is a CSRF token still needed today? > > All my users use a modern browser. > > It would be very nice if I could get rid of the CSRF token. > > Is t

Re: CSRF token still needed today?

2020-04-19 Thread Alex Heyden
com/en/3.0/ref/csrf/ > ... and then I look at this page: https://scotthelme.co.uk/csrf-is-dead/ > > Is a CSRF token still needed today? > > All my users use a modern browser. > > It would be very nice if I could get rid of the CSRF token. > > Is there a safe way to avoid CSR

Re: CSRF token still needed today?

2020-04-19 Thread Jorge Gimeno
On Sun, Apr 19, 2020 at 1:12 PM guettli wrote: > iI look at this page: https://docs.djangoproject.com/en/3.0/ref/csrf/ > ... and then I look at this page: https://scotthelme.co.uk/csrf-is-dead/ > > Is a CSRF token still needed today? > > All my users use a modern browser. &g

CSRF token still needed today?

2020-04-19 Thread guettli
iI look at this page: https://docs.djangoproject.com/en/3.0/ref/csrf/ ... and then I look at this page: https://scotthelme.co.uk/csrf-is-dead/ Is a CSRF token still needed today? All my users use a modern browser. It would be very nice if I could get rid of the CSRF token. Is there a safe way