Django CSRF_COOKIE_DOMAIN - how to change gracefully

Question

I have a public Django site which uses CSRF protection.

I have not set the CSRF_COOKIE_DOMAIN. My site uses subdomains.

Sometimes, a user ends up having a csrftoken cookie set on .toplevel.com as well as on sub.toplevel.com. This causes problems, as CSRF checking fails if the wrong cookie is used in the check.

I would like to set a CSRF_COOKIE_DOMAIN to .toplevel.com. However, I would also like to delete any csrftoken cookies for any *.toplevel.com subdomains. How would I do this?

If I do not delete the other cookies, I will just end up in the original situation of having two cookies with the same name on different domains, which causes issues.

Answer 1

I had a similar problem. The way I dealt with it is together with CSRF_COOKIE_DOMAIN I also changed the CSRF_COOKIE_NAME, making old "csrftoken" cookies obsolete.