Merge pull request #196 from readthedocs/davidfischer/reduce-csrf-coo…

…kie-timeout CSRF Cookie tweaks
readthedocs · Jul 27, 2020 · 9d65901 · 9d65901
2 parents 9480fed + 3137e65
commit 9d65901
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/config/settings/base.py b/config/settings/base.py
@@ -254,6 +254,8 @@
 X_FRAME_OPTIONS = "DENY"
 SESSION_COOKIE_HTTPONLY = True
 CSRF_COOKIE_HTTPONLY = True
+CSRF_COOKIE_AGE = 60 * 60 * 24 * 30  # 30 days
+CSRF_COOKIE_SAMESITE = "Strict"
 
 GEOIP_PATH = os.path.join(BASE_DIR, "geoip")