CGM_Public/pretix_cgo
1
0
Fork 0
forked from CGM_Public/pretix_original
Code Pull Requests Actions Activity

Fix delete_cookie for partitioned legacy CSRF cookie

Browse Source
This commit is contained in:
Richard Schreiber
2026-03-24 09:03:11 +01:00
committed by Kara Engelhardt
parent a71efa6747
commit 777b504bbe
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/pretix/multidomain/middlewares.py
View File

@@ -33,6 +33,7 @@
# License for the specific language governing permissions and limitations under the License. # License for the specific language governing permissions and limitations under the License.
import time import time
from datetime import datetime
from urllib.parse import urlparse from urllib.parse import urlparse
from django.conf import settings from django.conf import settings
@@ -252,8 +253,15 @@ class CsrfViewMiddleware(BaseCsrfMiddleware):
# Set the CSRF cookie even if it's already set, so we renew # Set the CSRF cookie even if it's already set, so we renew
# the expiry timer. # the expiry timer.
if is_secure and settings.CSRF_COOKIE_NAME in request.COOKIES: # remove legacy cookie if is_secure and settings.CSRF_COOKIE_NAME in request.COOKIES: # remove legacy cookie
response.delete_cookie(settings.CSRF_COOKIE_NAME) # response.delete_cookie does not work as we might have set a partitioned cookie
response.delete_cookie(settings.CSRF_COOKIE_NAME, samesite="None") set_cookie_without_samesite(
request, response,
settings.CSRF_COOKIE_NAME,
expires=datetime.utcfromtimestamp(0).strftime("%a, %d %b %Y %H:%M:%S GMT"),
path=settings.CSRF_COOKIE_PATH,
secure=is_secure,
httponly=settings.CSRF_COOKIE_HTTPONLY
)
set_cookie_without_samesite( set_cookie_without_samesite(
request, response, request, response,
'__Host-' + settings.CSRF_COOKIE_NAME if is_secure else settings.CSRF_COOKIE_NAME, '__Host-' + settings.CSRF_COOKIE_NAME if is_secure else settings.CSRF_COOKIE_NAME,