Search code examples
djangocsrfhttponly

Django CSRF cookie HttpOnly

Is it possible to set the django csrf cookie to be http-only? Alike to SESSION_COOKIE_HTTPONLY with session cookie, but for the csrf one?

Solution

  • A new setting, CSRF_COOKIE_HTTPONLY, is available in Django 1.6+.