From 9b729ddd8f2040722971ccfb3b12f7d8162633d1 Mon Sep 17 00:00:00 2001
From: Roger Hu <roger.hu@gmail.com>
Date: Tue, 4 Mar 2014 00:52:28 +0000
Subject: Fixed #22185 -- Added settings.CSRF_COOKIE_AGE

Thanks Paul McMillan for the review.
---
 docs/ref/contrib/csrf.txt |  1 +
 docs/ref/settings.txt     | 22 ++++++++++++++++++++++
 docs/releases/1.7.txt     |  6 ++++++
 3 files changed, 29 insertions(+)

(limited to 'docs')

diff --git a/docs/ref/contrib/csrf.txt b/docs/ref/contrib/csrf.txt
index 5c73ba3242..4c37f7448c 100644
--- a/docs/ref/contrib/csrf.txt
+++ b/docs/ref/contrib/csrf.txt
@@ -491,6 +491,7 @@ Settings
 
 A number of settings can be used to control Django's CSRF behavior:
 
+* :setting:`CSRF_COOKIE_AGE`
 * :setting:`CSRF_COOKIE_DOMAIN`
 * :setting:`CSRF_COOKIE_HTTPONLY`
 * :setting:`CSRF_COOKIE_NAME`
diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt
index f01ce3c7fd..9d133b73eb 100644
--- a/docs/ref/settings.txt
+++ b/docs/ref/settings.txt
@@ -324,6 +324,28 @@ See :doc:`/topics/cache`.
 
 .. _settings-csrf:
 
+.. setting:: CSRF_COOKIE_AGE
+
+CSRF_COOKIE_AGE
+---------------
+
+.. versionadded:: 1.7
+
+Default: ``31449600`` (1 year, in seconds)
+
+The age of CSRF cookies, in seconds.
+
+The reason for setting a long-lived expiration time is to avoid problems in
+the case of a user closing a browser or bookmarking a page and then loading
+that page from a browser cache. Without persistent cookies, the form submission
+would fail in this case.
+
+Some browsers (specifically Internet Explorer) can disallow the use of
+persistent cookies or can have the indexes to the cookie jar corrupted on disk,
+thereby causing CSRF protection checks to fail (and sometimes intermittently).
+Change this setting to ``None`` to use session-based CSRF cookies, which
+keep the cookies in-memory instead of on persistent storage.
+
 .. setting:: CSRF_COOKIE_DOMAIN
 
 CSRF_COOKIE_DOMAIN
diff --git a/docs/releases/1.7.txt b/docs/releases/1.7.txt
index 359bc4d217..fd1f44eb0d 100644
--- a/docs/releases/1.7.txt
+++ b/docs/releases/1.7.txt
@@ -446,6 +446,12 @@ Cache
   "non-expiring" by default. Previously, it was only possible to pass
   ``timeout=None` to the cache backend's ``set()`` method.
 
+Cross Site Request Forgery
+^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* The :setting:`CSRF_COOKIE_AGE` setting facilitates the use of session-based
+  CSRF cookies.
+
 Email
 ^^^^^
 
-- 
cgit v1.3