3 ms·
I am not familair with Django's CSRF tools, but you could write your own that didn't depend on cookies. Init a js var with a random token in the html somewhere,
by gibybo 15y ago
I am not familair with Django's CSRF tools, but you could write your own that didn't depend on cookies. Init a js var with a random token in the html somewhere, then require that the browser includes it with any state changing actions.
- riffraff 15y agoAFAICT django requires the token as a form parameter, which would be what you suggest doing with javascript. The issue is the "require that the browser includes it", as the information on the token must be available to the server too, and django apparently puts that in a cookie (rails does too, if the session is stored in the cookie). So I believe you have suggested a fix for the bit that works already, but not for grandparent's actual problem :)