Context Navigation

Changes between Initial Version and Version 1 of Ticket #27534

Timestamp:: Nov 25, 2016, 6:41:16 AM (8 years ago)
Author:: Tim Graham
Comment:: It seems fine, but allegedly CSRF_COOKIE_HTTPONLY doesn't provide any additional security. So I'm not sure if we're wasting our time enhancing its documentation rather than deemphasizing it in the documentation (or even removing it)?

Ticket #27534
- Property Summary Add CSRF_COOKIE_HTTP_ONLY note to CSRF AJAX docs → Add CSRF_COOKIE_HTTPONLY note to CSRF AJAX docs
- Property Type Uncategorized → Cleanup/optimization
- Property Version → master

initial	v1
2	2	https://docs.djangoproject.com/en/dev/ref/csrf/#ajax
3	3
4		There should be a note in the CSRF AJAX docs that the {{{CSRF_COOKIE_HTTP_ONLY}}} setting will prevent non-safe ajax calls from working (if using the js provided). It should note that you have to include the csrf token via the template tag {{{{% csrf_token %}}}}, and update the js with something like this:
	4	There should be a note in the CSRF AJAX docs that the {{{CSRF_COOKIE_HTTPONLY}}} setting will prevent non-safe ajax calls from working (if using the js provided). It should note that you have to include the csrf token via the template tag {{{{% csrf_token %}}}}, and update the js with something like this:
5	5	{{{#!javascript
6	6	var csrftoken = getCookie('csrftoken');