CODEWITHSUNDEEP
pythondjangocsrfpenetration-testingbreach-attack
oyilmaztekin
oyilmaztekin

Reputation: 753

How can I randomize csrf token for django admin

I've just got vulnerability report that came from pentesters for my Django project. The report says my Django app is vulnerable to the BREACH ATTACK. SSL is active, cookies are flagged as secure, session cookies are set as secure. HTTP Compressions closed by the sysadmin it is controlled from the Nginx that I have no access. So gzip is closed. Now I want to randomize csrf token for per client-side request for the django admin, especially for the login page. Is there a way to do this in settings.py in a simple way or do I have to write custom admin view? What is the best practice for this issue?

Upvotes: 0

Views: 166

Answers (0)

Related Questions