News for hackers. Stuff that matters.

A comment on Why do we have both CSRF protection and CORS?. Parent comment

Re:Why do we have both CSRF protection and CORS? by hansonkd on Monday March 03, 2025 @12:47PM (#43244524)
You don't need to store CSRF in sessions. Django doesn't by default.

CSRF token can be entirely separate from sessions.

[ Parent | on HN ]
Re:Why do we have both CSRF protection and CORS? by smagin on Monday March 03, 2025 @01:47PM (#43245253)
not even you don't need to, you shouldn't. Sessions shouldn't be accessible to js at all
[ Parent | on HN ]