Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

CSRF and CSRF REFRESH Cookie sets to Secure by default, Nothing Happens even if i change config manually.

See original GitHub issue

I have a development stage Flask App running. For now, I don’t want my cookies to be secure and as per docs, it’s false by default (I even tried it setting manually) but still the same error.

JWT_COOKIE_CSRF_PROTECT = True JWT_COOKIE_SECURE = False

my access_token and access_token_refresh is not getting secure attribute i.e it is working as expected but the same is not true for csrf cookies.

any suggestion or fix suggested.

PFA: Screen Shot of cookie storage![Screenshot from 2020-09-28 21-31-44](https://user-images.githubusercontent.com/70265793/94458089-13644e00-01d3-11eb-8413-f5376b96f363.png)

Issue Analytics

State:
Created 3 years ago
Comments:6 (3 by maintainers)

Top GitHub Comments

1reaction

vimalloccommented, Sep 29, 2020

Ugh. Well that’s really dumb and annoying. I guess you could try changing the cookie names via the JWT_ACCESS_CSRF_COOKIE_NAME and JWT_REFRESH_CSRF_COOKIE_NAME options to get around that, but it feels like a pretty brittle band-aid for the issue at hand. I don’t know what else to do for this situation thoug. Sorry! 😞

0reactions

mishraamrishcommented, Sep 29, 2020

I found this,

https://stackoverflow.com/questions/52763345/browsers-ignore-set-cookie-response-header-if-we-try-to-set-a-cookie-which-was-s This is the exact problem, I guess.

Top Results From Across the Web

CSRF and CSRF REFRESH Cookie sets to Secure by default ...

CSRF and CSRF REFRESH Cookie sets to Secure by default, Nothing Happens even if i change config manually.

Cross-Site Request Forgery Prevention Cheat Sheet

A CSRF attack works because browser requests automatically include all cookies including session cookies. Therefore, if the user is authenticated to the site, ......

19. Cross Site Request Forgery (CSRF) - Spring

This solution is to ensure that each request requires, in addition to our session cookie, a randomly generated token as an HTTP parameter....

Django CSRF Cookie Not Set - python - Stack Overflow

Show activity on this post. I'n stuck, I already cleared the cookie, used other browser but still csrf cookie not set. Do you...

Cross Site Request Forgery protection - Django documentation

The CSRF middleware and template tag provides easy-to-use protection against Cross Site Request Forgeries. This type of attack occurs when a malicious ...