SESSION_COOKIE_HTTPONLY = True在Django中不起作用：

Question

I have set the following code in my settings.py :

SESSION_COOKIE_HTTPONLY = True

even though the docs say this is default.

Then I use ./manage.py runserver and run OWASP Zap scanner on the site. But OWASP zap says that the cookie was set without the HttpOnly flag:

I also have this problem when I server the site with gunicorn and nginx . How can I get this flag set?

Using django 1.8 ; the page accounts/login is managed by django-registration-redux , if that is relevant.

Answer 1

The cookie you have highlighted in the screenshot is not the session cookie, it's the csrf cookie. There is a separate setting CSRF_COOKIE_HTTPONLY for this cookie. Unlike SESSION_COOKIE_HTTPONLY , CSRF_COOKIE_HTTPONLY defaults to False , so you need to add it in your settings.

CSRF_COOKIE_HTTPONLY = True

Note that setting the csrf cookie to http only will make it trickier to do ajax post requests. Instead of using the cookie, your javascript will have to pull the csrf token from the page instead.