651634 - Use django-session-csrf

Status: RESOLVED FIXED

(support.mozilla.org :: General, defect, P1)

Description

[James Socol [:jsocol, :james]]

See bug 649520. This is to start using it on SUMO.

Comment 1

[Ricky Rosario [:rrosario, :r1cky]]

Landed on Master:
https://github.com/jsocol/kitsune/commit/bf4e3d0965fdfb743e50ee2fd6fcf7fb45259fb8

Not testable until bug 652957 is resolved.

QA Test suggestions:
* Anonymous form POSTs (make sure none of these returns a 403/Access denied):
** login
** register
** password reset
** resend confirmation email
** AAQ process (as anonymous)
** article vote
** question "I have this problem too" + subscribe to updates after
** answer helpful/not helpful vote
** question "get email updates"
* Logged in form POSTs
** The normal smoke tests would be good (for example: post threads, questions, etc.). They will likely all work or none at all.

Comment 2

[Will Kahn-Greene [:willkg] ET needinfo? me]

These bugs are all resolved, so I'm removing the security flag from them.