Name of CSRF cookie is hard-coded.

Hey folks,

I’ve run into a problem with CSRF while using Dash with Django. The gist of it is that the route handler in our setup used for processing the _dash-update-component call requires CSRF (not something we can turn off). This is all fine, however, api.js in dash-renderer hardcodes the name of the cookie to read the token from

'X-CSRFToken': cookie.parse(document.cookie)._csrf_token

This means that we have to either change our cookie names across the project, or simply not use dash. I’d rather use it cause it’s a great product, but I can’t change our cookie name across the board.

Would it be possible to make this value configurable?

Thanks!

[chriddyp]

I believe that we aren’t actually using this token anymore, as we removed CSRF protection in https://github.com/plotly/dash/pull/146. This logic wasn’t removed in the dash front-end, and so I believe we are safe to remove it.

[alexcjohnson]

We’re merging dash-renderer into the dash repo. Moving this issue to the dash repo in case anyone is interested in following up. As mentioned we’d happily accept a PR to make the cookie and header configurable.