Clarify docs regarding CSRF token header name

[Stewart Polley]

I'm working on a small new application, and using AXIOS to post back to Django.

Part of this is of course setting the relevant header to include the CSRF token.
Looking at the docs there appears to be contradicting messages about what that heading should be.
Initially we get greeted with this:

For this reason, there is an alternative method: on each XMLHttpRequest, set a custom X-CSRFToken
header to the value of the CSRF token

Later on though we get this blockquote in the docs:

Note
...
The CSRF header name is HTTP_X_CSRFTOKEN by default, but you can customize it using the CSRF_HEADER_NAME setting.

From testing, it appears that X-CSRFToken is indeed the correct header to use, as it's currently functioning, but I'm unsure if this is a bug with Django, or an error in the docs.

If it's an error in the docs, can someone please point me in the direction of how to submit a pull request to fix this?

[Tim Graham]

The difference is explained on the ​settings reference page:

As with other HTTP headers in request.META, the header name received from the server is normalized by converting all characters to uppercase, replacing any hyphens with underscores, and adding an 'HTTP_' prefix to the name. For example, if your client sends a 'X-XSRF-TOKEN' header, the setting should be 'HTTP_X_XSRF_TOKEN'.

[Stewart Polley]

Thanks for that clarification.

Would you be open to making reference to that in the Documentation for CSRF tokens in AJAX Calls?
​https://docs.djangoproject.com/en/2.1/ref/csrf/#ajax

(Sorry, getting used to this formatting)

[Tim Graham]

I see your point. The note was moved lower in ddf169cdaca91e92dd5bfe6796bb6f38369ecb68 which didn't help. Could you review my ​PR?

[Stewart Polley]

I'll add some comments in the Pull Request

[Tim Graham <timograham@…>]

In a29fce8:

Fixed #29858 -- Clarified docs regarding CSRF token header name.

[Tim Graham <timograham@…>]

In 4acdba4:

[2.1.x] Fixed #29858 -- Clarified docs regarding CSRF token header name.

Backport of a29fce89845cc9ca2fa96d8880104726b75dfbd6 from master.