如何在不注销django的情况下突破框架？

Question

 _________
|A       |
|  _____ |
| |B   | |
| |____| |
|________|

The user is authenticated on django-based site B.

Site A attempts to display site B in an iframe.

Currently, site B will always log the user out when displayed in this manner. I assume this is some security feature of django. How can I simply make my site break out of the frame without the user being logged out?

edit: after testing this some more, it seems it only happens when Site A is also a django site.

Answer 1

I don't think this is a security feature of Django. The only thing like it in Django is clickjack protection, but that's still in the dev version only and doesn't work anything like this. It actually makes the site not load at all in the frame in modern browsers. See:

https://docs.djangoproject.com/en/dev/ref/clickjacking/

Are you sure there's nothing in your project that is implementing this behavior?

UPDATE BASED ON EDIT

That makes much more sense. It's because the cookies and sessions are overwriting each other. It's not so much "logging the user out" as simply inheriting the non-logged-in state of the parent frame.

Answer 2

使用settings.py的SESSION_COOKIE_NAME属性针对站点A或站点B更改用于身份验证的cookie。