1672713 - Remove django-session-csrf dependency

Status: RESOLVED FIXED

(Webtools Graveyard :: Pontoon, enhancement, P3)

Description

[Philipp Fischbeck]

The package django-session-csrf has not been updated in 4 years. Originally, it was apparently meant to save CSRF tokens in the session instead of cookies. However, I'm not sure this package currently does what it claims. Additionally, this behavior can be natively enabled in Django with CSRF_USE_SESSIONS, or we simply use the default way of storing them as a cookie.

Either way, the package is not required anymore, and getting rid of it would also simplify the BaseConfig.

I can submit a PR for this.

Comment 1

[Matjaz Horvat [:mathjazz]]

I believe we store the CSRF token in the session for security reasons, so I'd keep the practice, especially if Django allows us to do that natively.

Comment 2

[GitHub Bugzilla PR Linker]

Attachment: Link to GitHub pull-request: https://github.com/mozilla/pontoon/pull/1717