{"action":"created","comment":{"url":"https://api.github.com/repos/django/django/pulls/comments/89672738","pull_request_review_id":10216211,"id":89672738,"diff_hunk":"@@ -160,20 +162,50 @@ def _reject(self, request, reason):\n         )\n         return _get_failure_view()(request, reason=reason)\n \n-    def process_view(self, request, callback, callback_args, callback_kwargs):\n-        if getattr(request, 'csrf_processing_done', False):\n-            return None\n-\n-        try:\n-            cookie_token = request.COOKIES[settings.CSRF_COOKIE_NAME]\n-        except KeyError:\n-            csrf_token = None\n+    def _get_token(self, request):\n+        if settings.CSRF_USE_SESSIONS:\n+            try:\n+                return request.session.get(CSRF_SESSION_KEY)\n+            except AttributeError:\n+                raise ImproperlyConfigured(\n+                    'CSRF_USE_SESSIONS is enabled, but request.session is not set. Please make '\n+                    'sure you have sessions set up correctly.'\n+                )\n         else:\n+            try:\n+                cookie_token = request.COOKIES[settings.CSRF_COOKIE_NAME]\n+            except KeyError:\n+                return None\n+\n             csrf_token = _sanitize_token(cookie_token)\n             if csrf_token != cookie_token:\n                 # Cookie token needed to be replaced;\n                 # the cookie needs to be reset.\n                 request.csrf_cookie_needs_reset = True\n+            return csrf_token\n+\n+    def _set_token(self, request, response):\n+        if settings.CSRF_USE_SESSIONS:\n+            request.session[CSRF_SESSION_KEY] = request.META['CSRF_COOKIE']\n+        else:\n+            response.set_cookie(\n+                settings.CSRF_COOKIE_NAME,\n+                request.META['CSRF_COOKIE'],\n+                max_age=settings.CSRF_COOKIE_AGE,\n+                domain=settings.CSRF_COOKIE_DOMAIN,\n+                path=settings.CSRF_COOKIE_PATH,\n+                secure=settings.CSRF_COOKIE_SECURE,\n+                httponly=settings.CSRF_COOKIE_HTTPONLY\n+            )\n+            # Set the Vary header since content varies with the CSRF cookie.\n+            patch_vary_headers(response, ('Cookie',))\n+\n+    def process_view(self, request, callback, callback_args, callback_kwargs):\n+        if getattr(request, 'csrf_processing_done', False):","path":"django/middleware/csrf.py","position":67,"original_position":67,"commit_id":"7170890a112ce269808a29c9761a289071d7c604","original_commit_id":"7170890a112ce269808a29c9761a289071d7c604","user":{"login":"apollo13","id":81547,"avatar_url":"https://avatars.githubusercontent.com/u/81547?v=3","gravatar_id":"","url":"https://api.github.com/users/apollo13","html_url":"https://github.com/apollo13","followers_url":"https://api.github.com/users/apollo13/followers","following_url":"https://api.github.com/users/apollo13/following{/other_user}","gists_url":"https://api.github.com/users/apollo13/gists{/gist_id}","starred_url":"https://api.github.com/users/apollo13/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/apollo13/subscriptions","organizations_url":"https://api.github.com/users/apollo13/orgs","repos_url":"https://api.github.com/users/apollo13/repos","events_url":"https://api.github.com/users/apollo13/events{/privacy}","received_events_url":"https://api.github.com/users/apollo13/received_events","type":"User","site_admin":false},"body":"`getattr(request, 'csrf_processing_done')` would suffice since `None` is not true.","created_at":"2016-11-26T14:58:32Z","updated_at":"2016-11-26T14:58:32Z","html_url":"https://github.com/django/django/pull/5600#discussion_r89672738","pull_request_url":"https://api.github.com/repos/django/django/pulls/5600","_links":{"self":{"href":"https://api.github.com/repos/django/django/pulls/comments/89672738"},"html":{"href":"https://github.com/django/django/pull/5600#discussion_r89672738"},"pull_request":{"href":"https://api.github.com/repos/django/django/pulls/5600"}}},"pull_request":{"url":"https://api.github.com/repos/django/django/pulls/5600","id":50038827,"html_url":"https://github.com/django/django/pull/5600","diff_url":"https://github.com/django/django/pull/5600.diff","patch_url":"https://github.com/django/django/pull/5600.patch","issue_url":"https://api.github.com/repos/django/django/issues/5600","number":5600,"state":"open","locked":false,"title":"Refs #16859 -- Optionally store CSRF tokens in sessions","user":{"login":"raphaelm","id":64280,"avatar_url":"https://avatars.githubusercontent.com/u/64280?v=3","gravatar_id":"","url":"https://api.github.com/users/raphaelm","html_url":"https://github.com/raphaelm","followers_url":"https://api.github.com/users/raphaelm/followers","following_url":"https://api.github.com/users/raphaelm/following{/other_user}","gists_url":"https://api.github.com/users/raphaelm/gists{/gist_id}","starred_url":"https://api.github.com/users/raphaelm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/raphaelm/subscriptions","organizations_url":"https://api.github.com/users/raphaelm/orgs","repos_url":"https://api.github.com/users/raphaelm/repos","events_url":"https://api.github.com/users/raphaelm/events{/privacy}","received_events_url":"https://api.github.com/users/raphaelm/received_events","type":"User","site_admin":false},"body":"I'd love to have some review on this, but I'm fine with postponing the merge after Shai landed his changes to CSRF handling, as those two _will_ get merge conflicts.\n","created_at":"2015-11-07T16:03:37Z","updated_at":"2016-11-26T14:58:32Z","closed_at":null,"merged_at":null,"merge_commit_sha":"a6db90b334840c3e9cca6274938a67237e046419","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/django/django/pulls/5600/commits","review_comments_url":"https://api.github.com/repos/django/django/pulls/5600/comments","review_comment_url":"https://api.github.com/repos/django/django/pulls/comments{/number}","comments_url":"https://api.github.com/repos/django/django/issues/5600/comments","statuses_url":"https://api.github.com/repos/django/django/statuses/7170890a112ce269808a29c9761a289071d7c604","head":{"label":"raphaelm:ticket_16859","ref":"ticket_16859","sha":"7170890a112ce269808a29c9761a289071d7c604","user":{"login":"raphaelm","id":64280,"avatar_url":"https://avatars.githubusercontent.com/u/64280?v=3","gravatar_id":"","url":"https://api.github.com/users/raphaelm","html_url":"https://github.com/raphaelm","followers_url":"https://api.github.com/users/raphaelm/followers","following_url":"https://api.github.com/users/raphaelm/following{/other_user}","gists_url":"https://api.github.com/users/raphaelm/gists{/gist_id}","starred_url":"https://api.github.com/users/raphaelm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/raphaelm/subscriptions","organizations_url":"https://api.github.com/users/raphaelm/orgs","repos_url":"https://api.github.com/users/raphaelm/repos","events_url":"https://api.github.com/users/raphaelm/events{/privacy}","received_events_url":"https://api.github.com/users/raphaelm/received_events","type":"User","site_admin":false},"repo":{"id":24692186,"name":"django","full_name":"raphaelm/django","owner":{"login":"raphaelm","id":64280,"avatar_url":"https://avatars.githubusercontent.com/u/64280?v=3","gravatar_id":"","url":"https://api.github.com/users/raphaelm","html_url":"https://github.com/raphaelm","followers_url":"https://api.github.com/users/raphaelm/followers","following_url":"https://api.github.com/users/raphaelm/following{/other_user}","gists_url":"https://api.github.com/users/raphaelm/gists{/gist_id}","starred_url":"https://api.github.com/users/raphaelm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/raphaelm/subscriptions","organizations_url":"https://api.github.com/users/raphaelm/orgs","repos_url":"https://api.github.com/users/raphaelm/repos","events_url":"https://api.github.com/users/raphaelm/events{/privacy}","received_events_url":"https://api.github.com/users/raphaelm/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/raphaelm/django","description":"The Web framework for perfectionists with deadlines.","fork":true,"url":"https://api.github.com/repos/raphaelm/django","forks_url":"https://api.github.com/repos/raphaelm/django/forks","keys_url":"https://api.github.com/repos/raphaelm/django/keys{/key_id}","collaborators_url":"https://api.github.com/repos/raphaelm/django/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/raphaelm/django/teams","hooks_url":"https://api.github.com/repos/raphaelm/django/hooks","issue_events_url":"https://api.github.com/repos/raphaelm/django/issues/events{/number}","events_url":"https://api.github.com/repos/raphaelm/django/events","assignees_url":"https://api.github.com/repos/raphaelm/django/assignees{/user}","branches_url":"https://api.github.com/repos/raphaelm/django/branches{/branch}","tags_url":"https://api.github.com/repos/raphaelm/django/tags","blobs_url":"https://api.github.com/repos/raphaelm/django/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/raphaelm/django/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/raphaelm/django/git/refs{/sha}","trees_url":"https://api.github.com/repos/raphaelm/django/git/trees{/sha}","statuses_url":"https://api.github.com/repos/raphaelm/django/statuses/{sha}","languages_url":"https://api.github.com/repos/raphaelm/django/languages","stargazers_url":"https://api.github.com/repos/raphaelm/django/stargazers","contributors_url":"https://api.github.com/repos/raphaelm/django/contributors","subscribers_url":"https://api.github.com/repos/raphaelm/django/subscribers","subscription_url":"https://api.github.com/repos/raphaelm/django/subscription","commits_url":"https://api.github.com/repos/raphaelm/django/commits{/sha}","git_commits_url":"https://api.github.com/repos/raphaelm/django/git/commits{/sha}","comments_url":"https://api.github.com/repos/raphaelm/django/comments{/number}","issue_comment_url":"https://api.github.com/repos/raphaelm/django/issues/comments{/number}","contents_url":"https://api.github.com/repos/raphaelm/django/contents/{+path}","compare_url":"https://api.github.com/repos/raphaelm/django/compare/{base}...{head}","merges_url":"https://api.github.com/repos/raphaelm/django/merges","archive_url":"https://api.github.com/repos/raphaelm/django/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/raphaelm/django/downloads","issues_url":"https://api.github.com/repos/raphaelm/django/issues{/number}","pulls_url":"https://api.github.com/repos/raphaelm/django/pulls{/number}","milestones_url":"https://api.github.com/repos/raphaelm/django/milestones{/number}","notifications_url":"https://api.github.com/repos/raphaelm/django/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/raphaelm/django/labels{/name}","releases_url":"https://api.github.com/repos/raphaelm/django/releases{/id}","deployments_url":"https://api.github.com/repos/raphaelm/django/deployments","created_at":"2014-10-01T19:27:33Z","updated_at":"2015-06-04T08:17:39Z","pushed_at":"2016-11-17T19:07:03Z","git_url":"git://github.com/raphaelm/django.git","ssh_url":"git@github.com:raphaelm/django.git","clone_url":"https://github.com/raphaelm/django.git","svn_url":"https://github.com/raphaelm/django","homepage":"https://www.djangoproject.com/","size":144158,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"django:master","ref":"master","sha":"371adc472a2a1f09923101e3c4fda60cdff96028","user":{"login":"django","id":27804,"avatar_url":"https://avatars.githubusercontent.com/u/27804?v=3","gravatar_id":"","url":"https://api.github.com/users/django","html_url":"https://github.com/django","followers_url":"https://api.github.com/users/django/followers","following_url":"https://api.github.com/users/django/following{/other_user}","gists_url":"https://api.github.com/users/django/gists{/gist_id}","starred_url":"https://api.github.com/users/django/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/django/subscriptions","organizations_url":"https://api.github.com/users/django/orgs","repos_url":"https://api.github.com/users/django/repos","events_url":"https://api.github.com/users/django/events{/privacy}","received_events_url":"https://api.github.com/users/django/received_events","type":"Organization","site_admin":false},"repo":{"id":4164482,"name":"django","full_name":"django/django","owner":{"login":"django","id":27804,"avatar_url":"https://avatars.githubusercontent.com/u/27804?v=3","gravatar_id":"","url":"https://api.github.com/users/django","html_url":"https://github.com/django","followers_url":"https://api.github.com/users/django/followers","following_url":"https://api.github.com/users/django/following{/other_user}","gists_url":"https://api.github.com/users/django/gists{/gist_id}","starred_url":"https://api.github.com/users/django/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/django/subscriptions","organizations_url":"https://api.github.com/users/django/orgs","repos_url":"https://api.github.com/users/django/repos","events_url":"https://api.github.com/users/django/events{/privacy}","received_events_url":"https://api.github.com/users/django/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/django/django","description":"The Web framework for perfectionists with deadlines.","fork":false,"url":"https://api.github.com/repos/django/django","forks_url":"https://api.github.com/repos/django/django/forks","keys_url":"https://api.github.com/repos/django/django/keys{/key_id}","collaborators_url":"https://api.github.com/repos/django/django/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/django/django/teams","hooks_url":"https://api.github.com/repos/django/django/hooks","issue_events_url":"https://api.github.com/repos/django/django/issues/events{/number}","events_url":"https://api.github.com/repos/django/django/events","assignees_url":"https://api.github.com/repos/django/django/assignees{/user}","branches_url":"https://api.github.com/repos/django/django/branches{/branch}","tags_url":"https://api.github.com/repos/django/django/tags","blobs_url":"https://api.github.com/repos/django/django/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/django/django/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/django/django/git/refs{/sha}","trees_url":"https://api.github.com/repos/django/django/git/trees{/sha}","statuses_url":"https://api.github.com/repos/django/django/statuses/{sha}","languages_url":"https://api.github.com/repos/django/django/languages","stargazers_url":"https://api.github.com/repos/django/django/stargazers","contributors_url":"https://api.github.com/repos/django/django/contributors","subscribers_url":"https://api.github.com/repos/django/django/subscribers","subscription_url":"https://api.github.com/repos/django/django/subscription","commits_url":"https://api.github.com/repos/django/django/commits{/sha}","git_commits_url":"https://api.github.com/repos/django/django/git/commits{/sha}","comments_url":"https://api.github.com/repos/django/django/comments{/number}","issue_comment_url":"https://api.github.com/repos/django/django/issues/comments{/number}","contents_url":"https://api.github.com/repos/django/django/contents/{+path}","compare_url":"https://api.github.com/repos/django/django/compare/{base}...{head}","merges_url":"https://api.github.com/repos/django/django/merges","archive_url":"https://api.github.com/repos/django/django/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/django/django/downloads","issues_url":"https://api.github.com/repos/django/django/issues{/number}","pulls_url":"https://api.github.com/repos/django/django/pulls{/number}","milestones_url":"https://api.github.com/repos/django/django/milestones{/number}","notifications_url":"https://api.github.com/repos/django/django/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/django/django/labels{/name}","releases_url":"https://api.github.com/repos/django/django/releases{/id}","deployments_url":"https://api.github.com/repos/django/django/deployments","created_at":"2012-04-28T02:47:18Z","updated_at":"2016-11-26T14:58:22Z","pushed_at":"2016-11-26T11:05:28Z","git_url":"git://github.com/django/django.git","ssh_url":"git@github.com:django/django.git","clone_url":"https://github.com/django/django.git","svn_url":"https://github.com/django/django","homepage":"https://www.djangoproject.com/","size":219300,"stargazers_count":22306,"watchers_count":22306,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":9011,"mirror_url":null,"open_issues_count":121,"forks":9011,"open_issues":121,"watchers":22306,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/django/django/pulls/5600"},"html":{"href":"https://github.com/django/django/pull/5600"},"issue":{"href":"https://api.github.com/repos/django/django/issues/5600"},"comments":{"href":"https://api.github.com/repos/django/django/issues/5600/comments"},"review_comments":{"href":"https://api.github.com/repos/django/django/pulls/5600/comments"},"review_comment":{"href":"https://api.github.com/repos/django/django/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/django/django/pulls/5600/commits"},"statuses":{"href":"https://api.github.com/repos/django/django/statuses/7170890a112ce269808a29c9761a289071d7c604"}}}}
{"actor":{"display_login":"apollo13"}}