django-session-csrf-cookie
is Django middleware that provides a CSRF token cookie when using django-session-csrf. By design, django-session-csrf does not require a CSRF token cookie, but such a cookie is useful for AJAX requests and other web APIs, since it allows the client to get the CSRF token without parsing HTML. (Note that the cookie is not used by the server for any purpose, so the security hole django-session-csrf was designed to fix is still fixed.)
From PyPI:
pip install django-session-csrf-cookie
From github:
git clone git://github.com/trustcentric/django-session-csrf-cookie.git
Add session_csrf_cookie.CsrfCookieMiddleware
to your MIDDLEWARE_CLASSES
below session_csrf.CsrfMiddleware
:
MIDDLEWARE_CLASSES = (
...
'session_csrf.CsrfMiddleware',
'session_csrf_cookie.CsrfCookieMiddleware',
...
)
Add session_csrf_cookie
to INSTALLED_APPS
.
session-csrf-cookie-middleware
can be controlled using the following settings:
CSRF_COOKIE_NAME
The name used for the CSRF token cookie.
Default:
csrftoken
CSRF_COOKIE_DOMAIN
The domain to be used when setting the CSRF cookie.
Default: None
CSRF_COOKIE_SECURE
Whether to use a secure cookie for the CSRF cookie.
Default: False
CSRF_COOKIE_HTTPONLY
Whether to set the HTTPOnly flag on the CSRF cookie.
Default: False