test0908
/
django
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[3.1.x] Refs #28741 -- Doc'd SESSION_COOKIE_DOMAIN requirement with CSRF_USE_SESSIONS. 

Similar considerations as refs #32065, again adding some nuance to
afd375fc34.

Backport of 2e7ba6057c from master
This commit is contained in:
Tim Graham 2021-01-02 19:56:54 -05:00 committed by Mariusz Felisiak
parent a7e2f6c257
commit f4db2d16ec
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/ref/settings.txt
View File

@ -3172,6 +3172,10 @@ The domain to use for session cookies. Set this to a string such as
``"example.com"`` for cross-domain cookies, or use ``None`` for a standard ``"example.com"`` for cross-domain cookies, or use ``None`` for a standard
domain cookie. domain cookie.
To use cross-domain cookies with :setting:`CSRF_USE_SESSIONS`, you must include
a leading dot (e.g. ``".example.com"``) to accommodate the CSRF middleware's
referer checking.
Be cautious when updating this setting on a production site. If you update Be cautious when updating this setting on a production site. If you update
this setting to enable cross-domain cookies on a site that previously used this setting to enable cross-domain cookies on a site that previously used
standard domain cookies, existing user cookies will be set to the old standard domain cookies, existing user cookies will be set to the old