Re: Debugging CSRF protection false positives
Lukas Graf <l.graf-/8aE7x569Db/[email protected]>
| Newsgroups | gmane.comp.web.zope.plone.devel |
|---|---|
| Message-ID | <[email protected]> |
Thank you! I’ll see that I can integrate it into the docs somehow - a dedicated section for debugging CSRF issues does indeed seem like a good idea. Or if anyone beats me to it, feel free to use the post as a whole or rip out any parts deemed useful for inclusion in the docs or any product READMEs. Lukas -- 4teamwork AG Lukas Graf Senior Developer Engehaldenstrasse 53 CH-3012 Bern Tel +41 31 511 04 22 Fax +41 31 305 90 25 lukas.graf-/8aE7x569Db/[email protected] www.4teamwork.ch Folgen Sie uns auf Twitter: @4teamwork On 13 Oct 2015, at 07:36, Víctor Fernández de Alba <[email protected]> wrote: > Awesome post!! > I think is a candidate to make it to the Plone docs and have its own section. > The troubleshooting of write-on-read transactions is very useful to be included here too: > http://docs.plone.org/manage/troubleshooting/transactions.html > > Thanks! > V. > > On 12 Oct 2015, at 22:36, Lukas Graf <l.graf-/8aE7x569Db/[email protected]> wrote: > >> Hey, >> >> I just published a post on our development blog on how to debug issues with false positives from automatic CSRF protection (introduced to Plone 4 with the recent plone4.csrffixes security patch): >> >> http://devblog.4teamwork.ch/blog/2015/10/12/debugging-csrf-protection-false-positives-in-plone/ >> >> If you're developing an add-on and are seeing a dialog that asks the user to confirm their action, this post should help you understand what's going on, and how to debug and fix the issue. >> >> We've been using the automatic CSRF protection from plone.protect with Plone 4 for a while now, so I thought I'd share our experiences and some code to help debug the trickier kind of false positives. >> >> Have a wonderful conference everyone! >> >> Lukas >> >> -- >> 4teamwork AG >> Lukas Graf >> Senior Developer >> Engehaldenstrasse 53 >> CH-3012 Bern >> >> Tel +41 31 511 04 22 >> Fax +41 31 305 90 25 >> >> lukas.graf-/8aE7x569Db/[email protected] >> www.4teamwork.ch >> >> Folgen Sie uns auf Twitter: @4teamwork >> >> ------------------------------------------------------------------------------ >> _______________________________________________ >> Plone-developers mailing list >> Plone-developers-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org >> https://lists.sourceforge.net/lists/listinfo/plone-developers ------------------------------------------------------------------------------ _______________________________________________ Plone-developers mailing list Plone-developers-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org https://lists.sourceforge.net/lists/listinfo/plone-developers