From 720888a14699a80a6cd07d32514b9dcd5b1005fb Mon Sep 17 00:00:00 2001 From: Aymeric Augustin Date: Thu, 7 Feb 2013 09:48:08 +0100 Subject: Fixed #15808 -- Added optional HttpOnly flag to the CSRF Cookie. Thanks Samuel Lavitt for the report and Sascha Peilicke for the patch. --- docs/ref/contrib/csrf.txt | 1 + docs/ref/settings.txt | 13 +++++++++++++ 2 files changed, 14 insertions(+) (limited to 'docs/ref') diff --git a/docs/ref/contrib/csrf.txt b/docs/ref/contrib/csrf.txt index 3ad16e2f97..14522d8dbc 100644 --- a/docs/ref/contrib/csrf.txt +++ b/docs/ref/contrib/csrf.txt @@ -491,6 +491,7 @@ Settings A number of settings can be used to control Django's CSRF behavior: * :setting:`CSRF_COOKIE_DOMAIN` +* :setting:`CSRF_COOKIE_HTTPONLY` * :setting:`CSRF_COOKIE_NAME` * :setting:`CSRF_COOKIE_PATH` * :setting:`CSRF_COOKIE_SECURE` diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt index d4c6868ced..9a615b2d99 100644 --- a/docs/ref/settings.txt +++ b/docs/ref/settings.txt @@ -281,6 +281,19 @@ Please note that the presence of this setting does not imply that Django's CSRF protection is safe from cross-subdomain attacks by default - please see the :ref:`CSRF limitations ` section. +.. setting:: CSRF_COOKIE_HTTPONLY + +CSRF_COOKIE_HTTPONLY +-------------------- + +.. versionadded:: 1.6 + +Default: ``False`` + +Whether to use HttpOnly flag on the CSRF cookie. If this is set to ``True``, +client-side JavaScript will not to be able to access the CSRF cookie. See +:setting:`SESSION_COOKIE_HTTPONLY` for details on HttpOnly. + .. setting:: CSRF_COOKIE_NAME CSRF_COOKIE_NAME -- cgit v1.3