On Thursday, April 20, 2023 at 1:00:05 PM UTC+2 Jure Erznožnik wrote:
OK, I'll bite:
For the first issue, my problem revolved around this code:
@property def POST(self): # Ensure that request.POST uses our request
parsing. if not _hasattr(self, '_data'): self._load_data_and_files() if
is_form_media_type(self.content_type): return self._data
return QueryDict('', encoding=self._request._encoding)
That code looks correct. I cannot tell you why self._data would be lost,
but the empty QueryDict for request.POST makes sense. Please note that my
comments only apply to the Django codebase itself, I don't really know what
DRF does aside from that
IIUC, this code tries to match the token received from the headers with one
that's supposed to be in the form data payload. The code is allowed to fail
just fine, but in this case it has the side-effect mentioned: the form
payload will have been parsed and cannot be parsed again - while at the
same time rejecting the parsed data because it is not form payload type.
It compares the value from the cookie with either the value from the header
or the form payload. There is no need to parse it again,
_load_data_and_files from above does this and sets it:
https://github.com/encode/django-rest-framework/blob/38a74b42da10576857d6bf8bd82a73b15d12a7ed/rest_framework/request.py#L283
If you use application/json you need to access request.data in DRF,
request.POST will always be empty.
What I was trying to say with that paragraph was that I'd like to actually
figure out a way to START doing token rotation because my observation is
that it's currently NOT rotating and is therefore a lot less useful as a
security measure.
Oh then I did misread you. It is not neccessary to rotate the token every
request, reusing the token that you obtain once is just fine.
Cheers,
Florian
--
You received this message because you are subscribed to the Google Groups
"Django developers (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to django-developers+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-developers/263b4b04-f986-42fc-9e1d-1fc7a4e4b264n%40googlegroups.com.
