Django CSRF cookie HttpOnly

csrf, django, httponly

Solution

A new setting, `CSRF_COOKIE_HTTPONLY`, is available in Django 1.6+.

Problem

Is it possible to set the django csrf cookie to be http-only? Alike to `SESSION_COOKIE_HTTPONLY` with session cookie, but for the csrf one?

Original source