Wen 95e6e4e735 docs(django-security): keep the CSRF cookie readable for the AJAX example ...

The AJAX example reads csrftoken from document.cookie, which fails when
CSRF_COOKIE_HTTPONLY is True. Drop the setting from the production
block (the default is False) and set it to False in the CSRF block, as
the .kiro copy already does there. Also remove SECURE_BROWSER_XSS_FILTER,
which Django 4.0 removed. Updated .kiro and regenerated pi/core.

Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit bdc4407edf)

2026-10-20 18:01:40 -04:00

..

core

docs(django-security): keep the CSRF cookie readable for the AJAX example

2026-10-20 18:01:40 -04:00