From 2e7ba6057cfc82a15a22b6021cd60cf307152e2d Mon Sep 17 00:00:00 2001 From: Tim Graham Date: Sat, 2 Jan 2021 19:56:54 -0500 Subject: [PATCH] Refs #28741 -- Doc'd SESSION_COOKIE_DOMAIN requirement with CSRF_USE_SESSIONS. Similar considerations as refs #32065, again adding some nuance to afd375fc343baa46e61036087bc43b3d096bb0ca. --- docs/ref/settings.txt | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt index 856d4cc36b..5fdb76b2d0 100644 --- a/docs/ref/settings.txt +++ b/docs/ref/settings.txt @@ -3167,6 +3167,10 @@ The domain to use for session cookies. Set this to a string such as ``"example.com"`` for cross-domain cookies, or use ``None`` for a standard domain cookie. +To use cross-domain cookies with :setting:`CSRF_USE_SESSIONS`, you must include +a leading dot (e.g. ``".example.com"``) to accommodate the CSRF middleware's +referer checking. + Be cautious when updating this setting on a production site. If you update this setting to enable cross-domain cookies on a site that previously used standard domain cookies, existing user cookies will be set to the old