I'd like to redirect a visitor to the login page if he's not authenticated and she/he wants to access a protected page. I can handle this via the backend code, but it's easier to make it using HTML. My question is: Is it secure to use the meta http-equiv in my case?

{% block body %}

  {% if user.is_authenticated %}
    <meta http-equiv="REFRESH" content="0;url={{ BASE_URL }}">

  {% else %}
    <form method="post" action="." class="form-horizontal" role="form">
      {% csrf_token %}
      {{ form|crispy }}
      <input type="submit" id="btn-login" class="btn btn-success" value="Login">
      <input name="next" type="hidden" value="{{next}}">
  {% endif %}

{% endblock %}
  • It is much nicer to send the user to the login page with a query param of next_url that sends them to the page they wanted after login. Nobody does what you want to do. But I admin I don't see a security problem. – Z.T. Jun 30 '19 at 21:53
  • I'd say the security implications are minimal; this mainly affects usability. – multithr3at3d Jun 30 '19 at 23:50

You should either redirect the request with a 302 response or forward the page in your backend.

You can not be sure that the <meta http-equiv="REFRESH" ...> is actually performed in the browser. There might be some browsers, which do not support it and there are even browser addons which block such meta actions: Chrome Auto Refresh Blocker

Beside that the <meta http-equiv="REFRESH" ...> is deprecated and should not me used anymore (W3C).

If you want to use it anyway you have to make sure that you do not expose any data for not authenticated requests.

  • 5
    careful with 301! If the user logs in and gets back to the URL but the browser remembers the 301, it won't work! So "unauthenticated" is always 302, not 301. – Z.T. Jun 30 '19 at 22:41
  • @Z.T. You are right. I removed 301 from my post. Thanks for noticing. – Samuel Philipp Jul 1 '19 at 3:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.