It looks like it dates back to the Django 1.1 refactor and extension in https://github.com/django/django/commit/8e70cef9b67433edd70935dcc30c621d1e7fc0a0 ticket #9977, for which the referred wiki page ( https://code.djangoproject.com/wiki/CsrfProtection) is still up too with rationales about the design. I can't find any discussion about request.META vs attributes though, but since the move in the commit was from two middlewares to a unified one, maybe it was to do with that, since request.META is always there whilst attributes might not be if the middleware aren't set up properly? It seems like it could just be oversight. I would think that moving would require a standard deprecation period.
On Sat, 29 Dec 2018 at 11:47, Florian Apolloner <f.apollo...@gmail.com> wrote: > Hi there, > > I am considering rewriting and (hopefully) simplifying the CSRF > middleware. While looking through the code I realized that we put stuff > into request.META as well as attributes on the request object itself > (csrf_cookie_needs_reset) for instance. Is there any reason why we do not > stick to one format? > > Or more generally put: When should middlewares write into META as opposed > to a attribute. > > Cheers, > Florian > > -- > You received this message because you are subscribed to the Google Groups > "Django developers (Contributions to Django itself)" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to django-developers+unsubscr...@googlegroups.com. > To post to this group, send email to django-developers@googlegroups.com. > Visit this group at https://groups.google.com/group/django-developers. > To view this discussion on the web visit > https://groups.google.com/d/msgid/django-developers/43f6d8da-c66c-4100-a6d6-e85d4cef3684%40googlegroups.com > <https://groups.google.com/d/msgid/django-developers/43f6d8da-c66c-4100-a6d6-e85d4cef3684%40googlegroups.com?utm_medium=email&utm_source=footer> > . > For more options, visit https://groups.google.com/d/optout. > -- Adam -- You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group. To unsubscribe from this group and stop receiving emails from it, send an email to django-developers+unsubscr...@googlegroups.com. To post to this group, send email to django-developers@googlegroups.com. Visit this group at https://groups.google.com/group/django-developers. To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/CAMyDDM2OPG%3DZo_NG5WScJNq4RwVgAttgdWHJ27u45onr8XQ5tw%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
