title: CORS, Ajax, and CSRF
body: <p>The CSRF prevention support in a django application sends CSRF tokens down to a client via a cookie, and accepts CSRF tokens from the client in either a header (X-CSRFToken) or a cookie.  This works fine for non-CORS, non-AJAX web applications.  But it doesn't appear to work if you a) have a single page web app that communicates with the server via AJAX, and b) the single page webapp is hosted in a different domain than the server (CORS).  </p>
  
  <p>The issue is that the single page webapp (from domain1) cannot read the server domain (domain2) cookies using xhr.getResponseHeader or getCookie due to CORS restrictions. How can the javascript webapp send the appropriate CSRF token to the server given that it can't read the cookies?</p>
  
  <p>the xhr.getResponseHeader api is restricted from retrieving the Set-Cookie or Set-Cookie2 headers (by spec) and the various CORS-supporting browsers appear to enforce this restriction.  Similarly, the getCookie JS function will read all non-httpOnly cookies in the webapp domain (domain1), but will not read the ones set by the server in its domain (domain2).</p>
  
  <p>This is not a problem in non-CORS cases, but in our application, we wish to host the API in a different domain than the client webapp.  Any suggestions? </p>