Bypass CSRF check for Facebook canvas apps using POST for canvas

1
2
3
4
5
6
7
8
class IgnoreFbCsrfMiddleware(object):
    def process_request(self, request):
        
        signed_request = request.REQUEST.get('signed_request', None)
        
        signed_request = decode_signed_request(signed_request, settings.FACEBOOK_APP_SECRET)
        
        request.csrf_processing_done = signed_request != None

More like this

  1. Manual CSRF check for Django Facebook canvas applications by krvss 1 year, 8 months ago
  2. SignedForm: CSRF-protect forms with a hidden token field by exogen 4 years, 8 months ago
  3. HttpMethodsMiddleware by hawkeye 6 years, 1 month ago
  4. Facebook Authentication Backend by barnardo 2 years, 11 months ago
  5. create_c by catellar 1 year, 9 months ago

Comments

pyrou2 (on December 17, 2010):

adding

request.META["CSRF_COOKIE"] = _get_new_csrf_key()

will allow you to use {% crsf_token %} in further requests

class FacebookCsrfMiddleware(object):
    """
    Facebook CSRF protection
    """
    def process_request(self, request):
        signed_request = request.REQUEST.get('signed_request', None)
        signed_request = parse_signed_request(signed_request, settings.FACEBOOK_SECRET_KEY)
        if signed_request != None:
            from django.middleware.csrf import _get_new_csrf_key
            request.META["CSRF_COOKIE"] = _get_new_csrf_key()
            request.csrf_processing_done = True

#

subhranath (on March 22, 2011):

why not put a simple 'csrf_exempt' decorator on the view that where the 'signed_request' is encountered. Solves the need for the 'request.META["CSRF_COOKIE"] = _get_new_csrf_key()' anyway.

P.S. I'm assuming that we wont use this view for making any other sort of POST.

#

subhranath (on March 22, 2011):

And the rest of the views won't even have to go through the extra layer of the middleware stack. And even more, there won't even be a chance of POST parameter name clash of 'signed_request' intended for some other view, the use of which is very much probable in such this case.

#

krvss (on September 5, 2011):

There is an easier and more standard way: http://djangosnippets.org/snippets/2538/

#

stonan (on February 3, 2013):

great share thanks. spelautomater

#

Mia (on February 19, 2013):

so, thanks a lot for sharing this valuable information! VikingSlot - spelautomater

#

(Forgotten your password?)