In Django, when the `CSRF_COOKIE_HTTPONLY` setting is set to True, the CSRF cookie gains the httponly flag, which is desirable from a security perspective, but breaks the standard angular solution of adding this cookie to the httpProvider like so:

```
$httpProvider.defaults.xsrfCookieName = 'csrftoken';
$httpProvider.defaults.xsrfHeaderName = 'X-CSRFToken';

```

Through Django 1.9, there was a workaround where you could just pass the cookie directly to the app by putting this in the template:

```
<script>
    window.csrf_token = "{{ csrf_token }}";
</script>

```

And putting this in the angular app:

```
angularApp.config(["$httpProvider", function($httpProvider) {
    $httpProvider.defaults.headers.common["X-CSRFToken"] = window.csrf_token;
}]

```

Unfortunately, this doesn't work for single page angular apps in Django 1.10+ since the CSRF cookie changes after every request. How do you make post requests from Angular to Django 1.10+ with the `CSRF_COOKIE_HTTPONLY` setting on?  

**NB:** Disabling CSRF protection is not an acceptable answer.