UserLoggedInAuthentication: Show Error Message on failed CSRF validation

[encode]

UserLoggedInAuthentication: Show Error Message on failed CSRF validation

[tomchristie]

Seriously thanks so much for this one. The API stuff I have at the moment is un-authenticated so I woulda never have had the same hiccup with that. Yup totally right about referencing the AJAX CSRF docs. The error message stuff is a little more involved that in might seem at first sight seeing as there might be 0, 1 or many authenticators, and an authentication on one, many or all of the authenticators may not mean that the user doesn't have permission, plus the failed authentication responses might be either 401's or 403's, including the WWW-Authenticate header in the case of the 401's. Anyhoo, some of this has been in the (far) back of my head for a while, so I might try to pick up a bit of it this weekend.

[tomchristie]

Question is - what behavior do we expect here. Other authentication classes may also be present on the resource, and just because a request isn't CSRF validated it doesn't mean one of those other class might authenticate the request.

I guess the right thing to do is probably to check if request.user is authenticated, and throw a "CSRF failed!" response if it is.

[dbrgn]

I'm not sure about the inner workings of the CSRF validation and your code, but as long as a CSRF validation error (and only such an error) results in the correct error message, that would be OK for me :)