From 95e6e4e7358cb71ba90f7e7555a3f571a27e5f4f Mon Sep 17 00:00:00 2001 From: Wen Date: Wed, 14 Oct 2026 14:37:06 -0300 Subject: [PATCH] docs(django-security): keep the CSRF cookie readable for the AJAX example The AJAX example reads csrftoken from document.cookie, which fails when CSRF_COOKIE_HTTPONLY is True. Drop the setting from the production block (the default is False) and set it to False in the CSRF block, as the .kiro copy already does there. Also remove SECURE_BROWSER_XSS_FILTER, which Django 4.0 removed. Updated .kiro and regenerated pi/core. Signed-off-by: Wen (cherry picked from commit bdc4407edffa986896964599e982c6c33fc20271) --- .kiro/skills/django-security/SKILL.md | 3 --- pi/core/skills/django-security/SKILL.md | 5 +---- skills/django-security/SKILL.md | 5 +---- 3 files changed, 2 insertions(+), 11 deletions(-) diff --git a/.kiro/skills/django-security/SKILL.md b/.kiro/skills/django-security/SKILL.md index 0049e6601..f5cd27d9e 100644 --- a/.kiro/skills/django-security/SKILL.md +++ b/.kiro/skills/django-security/SKILL.md @@ -36,12 +36,10 @@ SECURE_HSTS_SECONDS = 31536000 # 1 year SECURE_HSTS_INCLUDE_SUBDOMAINS = True SECURE_HSTS_PRELOAD = True SECURE_CONTENT_TYPE_NOSNIFF = True -SECURE_BROWSER_XSS_FILTER = True X_FRAME_OPTIONS = 'DENY' # HTTPS and Cookies SESSION_COOKIE_HTTPONLY = True -CSRF_COOKIE_HTTPONLY = True SESSION_COOKIE_SAMESITE = 'Lax' CSRF_COOKIE_SAMESITE = 'Lax' @@ -311,7 +309,6 @@ def greet_user(username): ```python # settings.py SECURE_CONTENT_TYPE_NOSNIFF = True # Prevent MIME sniffing -SECURE_BROWSER_XSS_FILTER = True # Enable XSS filter X_FRAME_OPTIONS = 'DENY' # Prevent clickjacking # Custom middleware diff --git a/pi/core/skills/django-security/SKILL.md b/pi/core/skills/django-security/SKILL.md index 9e1fb25a0..9f25cc764 100644 --- a/pi/core/skills/django-security/SKILL.md +++ b/pi/core/skills/django-security/SKILL.md @@ -37,12 +37,10 @@ SECURE_HSTS_SECONDS = 31536000 # 1 year SECURE_HSTS_INCLUDE_SUBDOMAINS = True SECURE_HSTS_PRELOAD = True SECURE_CONTENT_TYPE_NOSNIFF = True -SECURE_BROWSER_XSS_FILTER = True X_FRAME_OPTIONS = 'DENY' # HTTPS and Cookies SESSION_COOKIE_HTTPONLY = True -CSRF_COOKIE_HTTPONLY = True SESSION_COOKIE_SAMESITE = 'Lax' CSRF_COOKIE_SAMESITE = 'Lax' @@ -312,7 +310,6 @@ def greet_user(username): ```python # settings.py SECURE_CONTENT_TYPE_NOSNIFF = True # Prevent MIME sniffing -SECURE_BROWSER_XSS_FILTER = True # Enable XSS filter X_FRAME_OPTIONS = 'DENY' # Prevent clickjacking # Custom middleware @@ -338,7 +335,7 @@ class SecurityHeaderMiddleware: ```python # settings.py - CSRF is enabled by default CSRF_COOKIE_SECURE = True # Only send over HTTPS -CSRF_COOKIE_HTTPONLY = True # Prevent JavaScript access +CSRF_COOKIE_HTTPONLY = False # False so AJAX can read csrf token from document.cookie; SESSION_COOKIE_HTTPONLY remains True CSRF_COOKIE_SAMESITE = 'Lax' # Prevent CSRF in some cases CSRF_TRUSTED_ORIGINS = ['https://example.com'] # Trusted domains diff --git a/skills/django-security/SKILL.md b/skills/django-security/SKILL.md index 9e1fb25a0..9f25cc764 100644 --- a/skills/django-security/SKILL.md +++ b/skills/django-security/SKILL.md @@ -37,12 +37,10 @@ SECURE_HSTS_SECONDS = 31536000 # 1 year SECURE_HSTS_INCLUDE_SUBDOMAINS = True SECURE_HSTS_PRELOAD = True SECURE_CONTENT_TYPE_NOSNIFF = True -SECURE_BROWSER_XSS_FILTER = True X_FRAME_OPTIONS = 'DENY' # HTTPS and Cookies SESSION_COOKIE_HTTPONLY = True -CSRF_COOKIE_HTTPONLY = True SESSION_COOKIE_SAMESITE = 'Lax' CSRF_COOKIE_SAMESITE = 'Lax' @@ -312,7 +310,6 @@ def greet_user(username): ```python # settings.py SECURE_CONTENT_TYPE_NOSNIFF = True # Prevent MIME sniffing -SECURE_BROWSER_XSS_FILTER = True # Enable XSS filter X_FRAME_OPTIONS = 'DENY' # Prevent clickjacking # Custom middleware @@ -338,7 +335,7 @@ class SecurityHeaderMiddleware: ```python # settings.py - CSRF is enabled by default CSRF_COOKIE_SECURE = True # Only send over HTTPS -CSRF_COOKIE_HTTPONLY = True # Prevent JavaScript access +CSRF_COOKIE_HTTPONLY = False # False so AJAX can read csrf token from document.cookie; SESSION_COOKIE_HTTPONLY remains True CSRF_COOKIE_SAMESITE = 'Lax' # Prevent CSRF in some cases CSRF_TRUSTED_ORIGINS = ['https://example.com'] # Trusted domains