set csrf cookie as httponly

[qcg-portal.git] / plgng / settings_common.py

diff --git a/plgng/settings_common.py b/plgng/settings_common.py
index 337f557..a2b39fe 100644 (file)
--- a/plgng/settings_common.py
+++ b/plgng/settings_common.py
@@ -111,6 +111,9 @@ SESSION_COOKIE_AGE = 60 * 60 * 24 * 6  # 6 days, length of user proxy from openi
 SESSION_SERIALIZER = 'django.contrib.sessions.serializers.PickleSerializer'
 
 
+CSRF_COOKIE_HTTPONLY = True
+
+
 # 3-rd party settings
 
 BOOTSTRAP3 = {