This adds a config option ensure_csrf_token to opt-out of django-nextjs automatically generating a CSRF token to include in the request to the NextJS server. It preserves the current behavior by defaulting to True.
The comment in _get_nextjs_request_cookies indicates this was done to support a GraphQL use case. But in our project, the behavior is undesirable because of the side-effect of including a Set-Cookie header (see next bullet).
A new CSRF token value was being generated on every request. This causes Django's CsrfViewMiddleware to include a Set-Cookie header on every response, making all responses from django-nextjs un-cacheable. This updates the behavior to only generate a CSRF token if the settings.CSRF_COOKIE_NAME cookie is not already present in the request.
This adds a config option
ensure_csrf_token
to opt-out ofdjango-nextjs
automatically generating a CSRF token to include in the request to the NextJS server. It preserves the current behavior by defaulting toTrue
._get_nextjs_request_cookies
indicates this was done to support a GraphQL use case. But in our project, the behavior is undesirable because of the side-effect of including aSet-Cookie
header (see next bullet).A new CSRF token value was being generated on every request. This causes Django's
CsrfViewMiddleware
to include aSet-Cookie
header on every response, making all responses fromdjango-nextjs
un-cacheable. This updates the behavior to only generate a CSRF token if thesettings.CSRF_COOKIE_NAME
cookie is not already present in the request.