{"action":"created","comment":{"url":"https://api.github.com/repos/django/django/pulls/comments/39642218","id":39642218,"diff_hunk":"@@ -257,11 +257,19 @@ The CSRF protection is based on the following things:\n    due to the fact that HTTP 'Set-Cookie' headers are (unfortunately) accepted\n    by clients that are talking to a site under HTTPS.  (Referer checking is not\n    done for HTTP requests because the presence of the Referer header is not\n-   reliable enough under HTTP.) Expanding the accepted referers beyond the\n-   current host can be done with the :setting:`CSRF_TRUSTED_ORIGINS` setting.\n+   reliable enough under HTTP.)\n \n-This ensures that only forms that have originated from your Web site can be used\n-to POST data back.\n+   If the :setting:`CSRF_COOKIE_DOMAIN` setting is set, the referer is compared\n+   against it. This setting supports subdomains. For example,\n+   ``CSRF_COOKIE_DOMAIN = '.example.com'`` will allow POST requests from\n+   ``www.example.com`` and ``api.example.com``. If the setting is not set, then\n+   the referer must match the ``Host`` header.\n+\n+   Expanding the accepted referers beyond the current host can","path":"docs/ref/csrf.txt","position":16,"original_position":16,"commit_id":"712bbdfc3128afcfd33a61721166ad43aac2ffcc","original_commit_id":"712bbdfc3128afcfd33a61721166ad43aac2ffcc","user":{"login":"carljm","id":61586,"avatar_url":"https://avatars.githubusercontent.com/u/61586?v=3","gravatar_id":"","url":"https://api.github.com/users/carljm","html_url":"https://github.com/carljm","followers_url":"https://api.github.com/users/carljm/followers","following_url":"https://api.github.com/users/carljm/following{/other_user}","gists_url":"https://api.github.com/users/carljm/gists{/gist_id}","starred_url":"https://api.github.com/users/carljm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/carljm/subscriptions","organizations_url":"https://api.github.com/users/carljm/orgs","repos_url":"https://api.github.com/users/carljm/repos","events_url":"https://api.github.com/users/carljm/events{/privacy}","received_events_url":"https://api.github.com/users/carljm/received_events","type":"User","site_admin":false},"body":"Why the extra indentation here?","created_at":"2015-09-16T15:11:30Z","updated_at":"2015-09-16T15:11:30Z","html_url":"https://github.com/django/django/pull/5286#discussion_r39642218","pull_request_url":"https://api.github.com/repos/django/django/pulls/5286","_links":{"self":{"href":"https://api.github.com/repos/django/django/pulls/comments/39642218"},"html":{"href":"https://github.com/django/django/pull/5286#discussion_r39642218"},"pull_request":{"href":"https://api.github.com/repos/django/django/pulls/5286"}}},"pull_request":{"url":"https://api.github.com/repos/django/django/pulls/5286","id":44990580,"html_url":"https://github.com/django/django/pull/5286","diff_url":"https://github.com/django/django/pull/5286.diff","patch_url":"https://github.com/django/django/pull/5286.patch","issue_url":"https://api.github.com/repos/django/django/issues/5286","number":5286,"state":"open","locked":false,"title":"Fixed #24496 -- Added CSRF Referer checking against CSRF_COOKIE_DOMAIN.","user":{"login":"timgraham","id":411869,"avatar_url":"https://avatars.githubusercontent.com/u/411869?v=3","gravatar_id":"","url":"https://api.github.com/users/timgraham","html_url":"https://github.com/timgraham","followers_url":"https://api.github.com/users/timgraham/followers","following_url":"https://api.github.com/users/timgraham/following{/other_user}","gists_url":"https://api.github.com/users/timgraham/gists{/gist_id}","starred_url":"https://api.github.com/users/timgraham/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timgraham/subscriptions","organizations_url":"https://api.github.com/users/timgraham/orgs","repos_url":"https://api.github.com/users/timgraham/repos","events_url":"https://api.github.com/users/timgraham/events{/privacy}","received_events_url":"https://api.github.com/users/timgraham/received_events","type":"User","site_admin":false},"body":"https://code.djangoproject.com/ticket/24496\r\n\r\nUpdated from https://github.com/django/django/pull/4337.","created_at":"2015-09-14T22:48:03Z","updated_at":"2015-09-16T15:11:30Z","closed_at":null,"merged_at":null,"merge_commit_sha":"18ea461c4982444997b502a00c58d7d577138f1b","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/django/django/pulls/5286/commits","review_comments_url":"https://api.github.com/repos/django/django/pulls/5286/comments","review_comment_url":"https://api.github.com/repos/django/django/pulls/comments{/number}","comments_url":"https://api.github.com/repos/django/django/issues/5286/comments","statuses_url":"https://api.github.com/repos/django/django/statuses/712bbdfc3128afcfd33a61721166ad43aac2ffcc","head":{"label":"timgraham:24496","ref":"24496","sha":"712bbdfc3128afcfd33a61721166ad43aac2ffcc","user":{"login":"timgraham","id":411869,"avatar_url":"https://avatars.githubusercontent.com/u/411869?v=3","gravatar_id":"","url":"https://api.github.com/users/timgraham","html_url":"https://github.com/timgraham","followers_url":"https://api.github.com/users/timgraham/followers","following_url":"https://api.github.com/users/timgraham/following{/other_user}","gists_url":"https://api.github.com/users/timgraham/gists{/gist_id}","starred_url":"https://api.github.com/users/timgraham/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timgraham/subscriptions","organizations_url":"https://api.github.com/users/timgraham/orgs","repos_url":"https://api.github.com/users/timgraham/repos","events_url":"https://api.github.com/users/timgraham/events{/privacy}","received_events_url":"https://api.github.com/users/timgraham/received_events","type":"User","site_admin":false},"repo":{"id":6815085,"name":"django","full_name":"timgraham/django","owner":{"login":"timgraham","id":411869,"avatar_url":"https://avatars.githubusercontent.com/u/411869?v=3","gravatar_id":"","url":"https://api.github.com/users/timgraham","html_url":"https://github.com/timgraham","followers_url":"https://api.github.com/users/timgraham/followers","following_url":"https://api.github.com/users/timgraham/following{/other_user}","gists_url":"https://api.github.com/users/timgraham/gists{/gist_id}","starred_url":"https://api.github.com/users/timgraham/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timgraham/subscriptions","organizations_url":"https://api.github.com/users/timgraham/orgs","repos_url":"https://api.github.com/users/timgraham/repos","events_url":"https://api.github.com/users/timgraham/events{/privacy}","received_events_url":"https://api.github.com/users/timgraham/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/timgraham/django","description":"The Web framework for perfectionists with deadlines.","fork":true,"url":"https://api.github.com/repos/timgraham/django","forks_url":"https://api.github.com/repos/timgraham/django/forks","keys_url":"https://api.github.com/repos/timgraham/django/keys{/key_id}","collaborators_url":"https://api.github.com/repos/timgraham/django/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/timgraham/django/teams","hooks_url":"https://api.github.com/repos/timgraham/django/hooks","issue_events_url":"https://api.github.com/repos/timgraham/django/issues/events{/number}","events_url":"https://api.github.com/repos/timgraham/django/events","assignees_url":"https://api.github.com/repos/timgraham/django/assignees{/user}","branches_url":"https://api.github.com/repos/timgraham/django/branches{/branch}","tags_url":"https://api.github.com/repos/timgraham/django/tags","blobs_url":"https://api.github.com/repos/timgraham/django/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/timgraham/django/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/timgraham/django/git/refs{/sha}","trees_url":"https://api.github.com/repos/timgraham/django/git/trees{/sha}","statuses_url":"https://api.github.com/repos/timgraham/django/statuses/{sha}","languages_url":"https://api.github.com/repos/timgraham/django/languages","stargazers_url":"https://api.github.com/repos/timgraham/django/stargazers","contributors_url":"https://api.github.com/repos/timgraham/django/contributors","subscribers_url":"https://api.github.com/repos/timgraham/django/subscribers","subscription_url":"https://api.github.com/repos/timgraham/django/subscription","commits_url":"https://api.github.com/repos/timgraham/django/commits{/sha}","git_commits_url":"https://api.github.com/repos/timgraham/django/git/commits{/sha}","comments_url":"https://api.github.com/repos/timgraham/django/comments{/number}","issue_comment_url":"https://api.github.com/repos/timgraham/django/issues/comments{/number}","contents_url":"https://api.github.com/repos/timgraham/django/contents/{+path}","compare_url":"https://api.github.com/repos/timgraham/django/compare/{base}...{head}","merges_url":"https://api.github.com/repos/timgraham/django/merges","archive_url":"https://api.github.com/repos/timgraham/django/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/timgraham/django/downloads","issues_url":"https://api.github.com/repos/timgraham/django/issues{/number}","pulls_url":"https://api.github.com/repos/timgraham/django/pulls{/number}","milestones_url":"https://api.github.com/repos/timgraham/django/milestones{/number}","notifications_url":"https://api.github.com/repos/timgraham/django/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/timgraham/django/labels{/name}","releases_url":"https://api.github.com/repos/timgraham/django/releases{/id}","created_at":"2012-11-22T15:27:43Z","updated_at":"2015-07-07T02:08:59Z","pushed_at":"2015-09-16T13:11:33Z","git_url":"git://github.com/timgraham/django.git","ssh_url":"git@github.com:timgraham/django.git","clone_url":"https://github.com/timgraham/django.git","svn_url":"https://github.com/timgraham/django","homepage":"http://www.djangoproject.com/","size":122017,"stargazers_count":1,"watchers_count":1,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":2,"mirror_url":null,"open_issues_count":0,"forks":2,"open_issues":0,"watchers":1,"default_branch":"master"}},"base":{"label":"django:master","ref":"master","sha":"76737593214a931dfa768708e0e5d7f9d7fa79c4","user":{"login":"django","id":27804,"avatar_url":"https://avatars.githubusercontent.com/u/27804?v=3","gravatar_id":"","url":"https://api.github.com/users/django","html_url":"https://github.com/django","followers_url":"https://api.github.com/users/django/followers","following_url":"https://api.github.com/users/django/following{/other_user}","gists_url":"https://api.github.com/users/django/gists{/gist_id}","starred_url":"https://api.github.com/users/django/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/django/subscriptions","organizations_url":"https://api.github.com/users/django/orgs","repos_url":"https://api.github.com/users/django/repos","events_url":"https://api.github.com/users/django/events{/privacy}","received_events_url":"https://api.github.com/users/django/received_events","type":"Organization","site_admin":false},"repo":{"id":4164482,"name":"django","full_name":"django/django","owner":{"login":"django","id":27804,"avatar_url":"https://avatars.githubusercontent.com/u/27804?v=3","gravatar_id":"","url":"https://api.github.com/users/django","html_url":"https://github.com/django","followers_url":"https://api.github.com/users/django/followers","following_url":"https://api.github.com/users/django/following{/other_user}","gists_url":"https://api.github.com/users/django/gists{/gist_id}","starred_url":"https://api.github.com/users/django/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/django/subscriptions","organizations_url":"https://api.github.com/users/django/orgs","repos_url":"https://api.github.com/users/django/repos","events_url":"https://api.github.com/users/django/events{/privacy}","received_events_url":"https://api.github.com/users/django/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/django/django","description":"The Web framework for perfectionists with deadlines.","fork":false,"url":"https://api.github.com/repos/django/django","forks_url":"https://api.github.com/repos/django/django/forks","keys_url":"https://api.github.com/repos/django/django/keys{/key_id}","collaborators_url":"https://api.github.com/repos/django/django/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/django/django/teams","hooks_url":"https://api.github.com/repos/django/django/hooks","issue_events_url":"https://api.github.com/repos/django/django/issues/events{/number}","events_url":"https://api.github.com/repos/django/django/events","assignees_url":"https://api.github.com/repos/django/django/assignees{/user}","branches_url":"https://api.github.com/repos/django/django/branches{/branch}","tags_url":"https://api.github.com/repos/django/django/tags","blobs_url":"https://api.github.com/repos/django/django/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/django/django/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/django/django/git/refs{/sha}","trees_url":"https://api.github.com/repos/django/django/git/trees{/sha}","statuses_url":"https://api.github.com/repos/django/django/statuses/{sha}","languages_url":"https://api.github.com/repos/django/django/languages","stargazers_url":"https://api.github.com/repos/django/django/stargazers","contributors_url":"https://api.github.com/repos/django/django/contributors","subscribers_url":"https://api.github.com/repos/django/django/subscribers","subscription_url":"https://api.github.com/repos/django/django/subscription","commits_url":"https://api.github.com/repos/django/django/commits{/sha}","git_commits_url":"https://api.github.com/repos/django/django/git/commits{/sha}","comments_url":"https://api.github.com/repos/django/django/comments{/number}","issue_comment_url":"https://api.github.com/repos/django/django/issues/comments{/number}","contents_url":"https://api.github.com/repos/django/django/contents/{+path}","compare_url":"https://api.github.com/repos/django/django/compare/{base}...{head}","merges_url":"https://api.github.com/repos/django/django/merges","archive_url":"https://api.github.com/repos/django/django/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/django/django/downloads","issues_url":"https://api.github.com/repos/django/django/issues{/number}","pulls_url":"https://api.github.com/repos/django/django/pulls{/number}","milestones_url":"https://api.github.com/repos/django/django/milestones{/number}","notifications_url":"https://api.github.com/repos/django/django/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/django/django/labels{/name}","releases_url":"https://api.github.com/repos/django/django/releases{/id}","created_at":"2012-04-28T02:47:18Z","updated_at":"2015-09-16T15:01:55Z","pushed_at":"2015-09-16T14:40:21Z","git_url":"git://github.com/django/django.git","ssh_url":"git@github.com:django/django.git","clone_url":"https://github.com/django/django.git","svn_url":"https://github.com/django/django","homepage":"https://www.djangoproject.com/","size":310688,"stargazers_count":15965,"watchers_count":15965,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":6437,"mirror_url":null,"open_issues_count":72,"forks":6437,"open_issues":72,"watchers":15965,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/django/django/pulls/5286"},"html":{"href":"https://github.com/django/django/pull/5286"},"issue":{"href":"https://api.github.com/repos/django/django/issues/5286"},"comments":{"href":"https://api.github.com/repos/django/django/issues/5286/comments"},"review_comments":{"href":"https://api.github.com/repos/django/django/pulls/5286/comments"},"review_comment":{"href":"https://api.github.com/repos/django/django/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/django/django/pulls/5286/commits"},"statuses":{"href":"https://api.github.com/repos/django/django/statuses/712bbdfc3128afcfd33a61721166ad43aac2ffcc"}}}}