News for hackers. Stuff that matters.

A comment on Why do we have both CSRF protection and CORS?. Parent comment

Re:Why do we have both CSRF protection and CORS? by smagin on Monday March 03, 2025 @10:37AM (#43242750)
> How does server know the cookie is valid if it doesn't store it

depending on why you'are asking the question, * because it decrypts correctly * because it contains some user identifier

People don't usually store sessions in cookies because cookies can't be very big, and session do become big. So what people do instead they store cookies in databases, and put session identifiers into cookies.

[ Parent | on HN ]
Re:Why do we have both CSRF protection and CORS? by hansonkd on Monday March 03, 2025 @12:47PM (#43244524)
You don't need to store CSRF in sessions. Django doesn't by default.

CSRF token can be entirely separate from sessions.

[ Parent | on HN ]
Re:Why do we have both CSRF protection and CORS? by smagin on Monday March 03, 2025 @01:47PM (#43245253)
not even you don't need to, you shouldn't. Sessions shouldn't be accessible to js at all
[ Parent | on HN ]