1214033 - Session CSRF cookies not needed for API views

Status: RESOLVED DUPLICATE of bug 1262424

(Socorro :: Webapp, task)

Description

[Peter Bengtsson [:peterbe]]

E.g. `curl -v https://crash-stats.mozilla.com/api/CrontabberState/ > /dev/null` shows that it sets a session cookie. We never need that. 

The point of setting that cookie is so that we check a CSRF cookie. That's never applicable on the API.

Comment 1

[Peter Bengtsson [:peterbe]]

Attachment: Link to Github pull-request: https://github.com/mozilla/socorro/pull/3266

Comment 2

[Peter Bengtsson [:peterbe]]

Ultimately this is premature optimization. Setting a session cookie in memcache isn't particularly expensive considering the types of loads and traffic we have. 
If we had gobs of API traffic this could be worth pursuing because, after all, creating a CSRF cookie does store a row in the django_sessions postgres table. 

A simpler solution might be to override the existing CSRF middleware classes and have it exit out early if the request path is /api/*.

Comment 3

[Will Kahn-Greene [:willkg] ET needinfo? me]

In the comments for PR 3266, we talked about working on bug #1262424 instead. I'm just going to dupe this to that one.