Logo of a fox dressed as a Doctor

Code Review Doctor

Verified by GitHub
GitHub integrationPython checksDjango checksDemoCheck repository

Cross Site Request Forgery protection weak to packet sniffing

Your website is vulnerable because the CSRF_COOKIE_SECURE setting is not set - so hackers have an easier time stealing your CSRF cookies on HTTP connections, allowing them to circumvent your CSRF protection.

CsrfMiddleware marks the CSRF cookie as secure when CSRF_COOKIE_SECURE = True, to make the browser only send cookie over secure HTTPS connection.

Cookies sent over insecure HTTP are unencrypted, so hackers can steal the CSRF cookie using a packet sniffer - allowing them to use it to trick the browser into thinking a request on their website was performed on your website by the logged a user.-.

If our GitHub code review bot spots this issue in your pull request it gives this advice:

django-doctorbotsuggested changes just now
settings.py
1
+
MIDDLEWARE = [
2
+
    'django.middleware.csrf.CsrfViewMiddleware',
3
+
    ...
4
+
]
Your website is vulnerable because the CSRF_COOKIE_SECURE setting is not set - so hackers have an easier time stealing your CSRF cookies on HTTP connections, allowing them to circumvent your CSRF protection.
Read more
Suggested changes
+
+
# feature flagged so can turn off in local development
+
CSRF_COOKIE_SECURE = literal_eval(getenv("HTTPS_ONLY", "True"))
Commit suggestion
Update settings.py
Instantly check if you have this issue for free
    Works with tools you use
    Read about how it works.