Preview and image insertion with CSRF_COOKIE_HTTPONLY = True

[neutronx]

Preview and image insertion with CSRF_COOKIE_HTTPONLY = True

[adi-]

https://docs.djangoproject.com/en/1.9/ref/settings/#std:setting-CSRF_COOKIE_HTTPONLY

[Zahtu]

Sorry, i don't quite understand. I have set this to true, and the behavior of the markdownx-widget changed.

[timgraham]

I was looking at using this package on djangoproject.com and also ran into this issue. If you don't want to change this, it could be useful to document that the package doesn't work with CSRF_COOKIE_HTTPONLY=True but is there is reason the CSRF token couldn't be retrieved from a form input instead?

[adi-]

In my opinion CSRF_COOKIE_HTTPONLY = True is a misleading security advice. Look also at this https://groups.google.com/forum/#!topic/django-developers/nXjfLd8ba5k to get the idea.

However, if HTTP COOKIE is helping you out with something else, it could be a point to support injecting the token into a hidden input field.