CSRF cookie fails on HttpOnly

[mailbackwards]

When CSRF_COOKIE_HTTPONLY is enabled in Django, django-rest-swagger always errors with:

{"detail": "CSRF Failed: CSRF token missing or incorrect."}

I think this is because it's unable to retrieve the CSRF token using $.cookie here. Instead it needs to grab it from the DOM. My current workaround is to add a {% csrf_token %} to the api_selector block and then manually set the cookie:

{% block body %}
  {{ block.super }}
  <script type="text/javascript">
    $.cookie('csrftoken', $("input[name='csrfmiddlewaretoken']").val());
  </script>
{% endblock %}

This feels like an ugly fix and potential security issue (since it's effectively undoing HTTPONLY) for a relatively common use case. My suggestion is a toggleable setting to conditionally include the CSRF token in the template, and conditionally look for that DOM value in shred.bundle.js instead of getting it from $.cookie.

[marcgibbons]

@mailbackwards This has been implemented in v2. Sorry for the late response!