Находки в опенсорсе: Python: “🚀 New issue to wemake-services/django-modern-rest by @sobolevn 📝 Do…”

🚀 New issue to wemake-services/django-modern-rest by @sobolevn
📝 Do not expose `reason` in `ensure_csrf` check (#1332)

Currently our responses show why CSRF check fails:

1.

django-modern-rest/dmr/internal/csrf.py

Line 12 in a2d44b1

2.

django-modern-rest/dmr/internal/csrf.py

Lines 35 to 44 in a2d44b1

It is even tested in some places as:

    assert json.loads(response.content) == snapshot({
        'detail': [
            {
                'msg': 'CSRF Failed: CSRF cookie not set.',
            },
        ],
    })

Which is not correct at all! We must only show this during the debug builds, not in production. Just like Django does:

1. https://github.com/django/django/blob/73cc09f14f13fedddc14d6ba5b287cb33c24e4a4/django/views/templates/csrf_403.html#L38-L46
2. https://github.com/django/django/blob/73cc09f14f13fedddc14d6ba5b287cb33c24e4a4/django/views/csrf.py#L22-L81

(please, do not take this issue before the 1st of September)

#bug #good_first_issue #help_wanted #security #opensource_september #django_modern_rest
sent via relator