django-planet
Posts
Blogs
Feeds
Authors
Posts
Blogs
Authors
Search
Home
Blogs
Josh Karamuth
Why CSRF token cookies don't need to be httpOnly
July 20, 2024
Why CSRF token cookies don't need to be httpOnly
in blog
Josh Karamuth
original entry
Why CSRF token cookies don't need to be httpOnly
CSRF token cookies are typically sent without httpOnly set to true. But is that a secure practice?
Recent Posts
Django News - django.tasks exists - Sep 26th 2025
Feature Flags: Deploy to some of the people all of the time, and all of the
Just-in-Time Development with Django and HTMX: Faster, Leaner, and Smarter
Anatomy of a Database Operation
One Thousand and One Django Sites
Europe, Django and two-factor authentication
Django Admin at Scale: From Milliseconds to Microseconds 🚀
Day 3 Lightning Talks
Closing session
Recap