Default path can cause unexpected CSRF token rejections

[jackc]

The default path for the CSRF cookie is the request path. This can lead to multiple instances of the CSRF cookie.

For example:

GET /foo/bar -> sets cookie with path of /foo/bar
GET /foo -> sets cookie with path of /foo

When a subsequent request is sent that matches both paths the CSRF token can be rejected. I'm not sure if it is sending both cookies or sending the wrong one. But the request is rejected. These errors can be quite confusing to diagnose.

I resolved this in my application by changing the path to /.

Would it be a good idea to change the default path to / or at least to document this potential problem?

[stale]

This issue has been automatically marked as stale because it hasn't seen a recent update. It'll be automatically closed in a few days.

[greywolve]

We ran into this recently too. Could we add something to the README which documents this gotcha? (We had to change the path to / as well to fix our issues)

[karelbilek]

@greywolve already made a PR :D

#147

[karelbilek]

I don't think it's a good idea to make the default path /, as that would be a big backwards compat change and could randomly break something somewhere.