822889 - "View Source" to a URL removes the csrf token, causing problems with django apps

Status: RESOLVED DUPLICATE of bug 156435

(Core :: Networking: Cookies, defect)

Description

[Rudi Sherry]

I am developing a django app so using localhost:8000 as the domain and port.

I'm using the csrf token built into django to prevent against cross-site request forgeries.

Unfortunately, that is breaking "View Source" in Firefox, because it does not send the csrf header when asking for the source of the page (the original GET request did).  My app automatically redirects to an error page, and the source I see is the error source rather than the page source.

I am using Firebug to debug and get the sources, but if I don't have Firebug loaded at the moment View Source is more convenient.

You can see this by going to the URL below.
* Create a user (it doesn't check email except for formatting of it). and checl "Remember me". You should see a page that is not the registration page.
* Then go to the URL again to make it a GET (instead of a POST), and you're now showing something other than the registration page.
* View Source (for this GET): you'll see the source for the login/registration page.

This is because View Source didn't send the csrf header.

Comment 1

[Loic]

Coud you attach the source code of the page displayed before and after (to compare during testing)?

Comment 2

[Rudi Sherry]

I'm not sure what you mean.  I can't get the source code "before" because View Source shows me the wrong source -- there is no "before".  I always see the correct thing in the browser web window, and always see the wrong thing in the View Source window.  Showing View Source doesn't change what's in the Web window (even if I reload it).

I'll copy text from Charles logs to show the requests and responses.

Comment 3

[Rudi Sherry]

Attachment: Request sent to server for the web page when browsing to it

Comment 4

[Rudi Sherry]

Attachment: Response to web page request.

Comment 5

[Rudi Sherry]

Attachment: Request sent to server for the web page on "View Source"

Comment 6

[Rudi Sherry]

Attachment: Response to "View Source" request

Comment 7

[Rudi Sherry]

Added the four attachments; compare the requests to the server when browsing to that page and we saying "View Source"... cookies are missing in the latter request.

Comment 8

[(mostly gone) XtC4UaLL [:xtc4uall]]

Dupe of/related to Bug 156435?

Comment 9

[Rudi Sherry]

Yes, I agree that this is a duplicate of that bug (whose last comment was two years old).