Debugging CSRF protection false positives
Lukas Graf <l.graf-/8aE7x569Db/[email protected]>
| Newsgroups | gmane.comp.web.zope.plone.devel |
|---|---|
| Message-ID | <[email protected]> |
Hey, I just published a post on our development blog on how to debug issues with false positives from automatic CSRF protection (introduced to Plone 4 with the recent plone4.csrffixes security patch): http://devblog.4teamwork.ch/blog/2015/10/12/debugging-csrf-protection-false-positives-in-plone/ If you're developing an add-on and are seeing a dialog that asks the user to confirm their action, this post should help you understand what's going on, and how to debug and fix the issue. We've been using the automatic CSRF protection from plone.protect with Plone 4 for a while now, so I thought I'd share our experiences and some code to help debug the trickier kind of false positives. Have a wonderful conference everyone! Lukas -- 4teamwork AG Lukas Graf Senior Developer Engehaldenstrasse 53 CH-3012 Bern Tel +41 31 511 04 22 Fax +41 31 305 90 25 lukas.graf-/8aE7x569Db/[email protected] www.4teamwork.ch Folgen Sie uns auf Twitter: @4teamwork ------------------------------------------------------------------------------ _______________________________________________ Plone-developers mailing list Plone-developers-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org https://lists.sourceforge.net/lists/listinfo/plone-developers