Ability to set csrf cookie path and https-only plus add 'secure'

[cfattarsi@…]

This is useful if you have multiple Django instances running under the same hostname. The csrf cookies can use different cookie paths, and each instance will only see
its own csrf cookie. That text is taken almost directly from the SESSION_COOKIE_PATH documentation, it would be nice if csrf cookies worked the same way.

[cfattarsi@…]

add CSRF_COOKIE_PATH option to settings.py

[Malcolm Tredinnick]

Absolutely required. We also need CSRF_COOKIE_SECURE. Changing title to reflect that and make this ticket about getting the missing pieces of the CSRF cookie config in place (just needs the "secure" option added).

[grendel]

Replying to mtredinnick:

Absolutely required. We also need CSRF_COOKIE_SECURE. Changing title to reflect that and make this ticket about getting the missing pieces of the CSRF cookie config in place (just needs the "secure" option added).

I have modified my local copy of Django to add the CSRF_COOKIE_SECURE feature.

Simply added in settings.py:

CSRF_COOKIE_SECURE = True

And in django/middleware/csrf.py

# Set the CSRF cookie even if it's already set, so we renew the expiry timer.
        response.set_cookie(settings.CSRF_COOKIE_NAME,
                request.META["CSRF_COOKIE"], max_age = 60 * 60 * 24 * 7 * 52,
                domain=settings.CSRF_COOKIE_DOMAIN,secure=settings.CSRF_COOKIE_SECURE)

Not much to it really and now my cookies are set as secure just like the Session cookie

[Luke Plant]

#15808 was a dupe

[Luke Plant]

In [16200]:

Fixed #14134 - ability to set cookie 'path' and 'secure' attributes of CSRF cookie

Thanks to cfattarsi for the report and initial patch.