Exclude reserved cookies in nextjs_request_cookies

Fixes #29
QueraTeam · Sep 2, 2023 · ea7c26a · ea7c26a
1 parent bed7a6e
commit ea7c26a
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/django_nextjs/render.py b/django_nextjs/render.py
@@ -1,4 +1,5 @@
 import warnings
+from http.cookies import Morsel
 from typing import Dict, Tuple, Union
 from urllib.parse import quote
 
@@ -13,6 +14,8 @@
 from .app_settings import NEXTJS_SERVER_URL
 from .utils import filter_mapping_obj
 
+morsel = Morsel()
+
 
 def _get_render_context(html: str, extra_context: Union[Dict, None] = None):
     a = html.find("<head>")
@@ -46,7 +49,8 @@ def _get_nextjs_request_cookies(request: HttpRequest):
     (i.e. dont use HTTP unsafe methods or GraphQL mutations).
     https://docs.djangoproject.com/en/3.2/ref/csrf/#is-posting-an-arbitrary-csrf-token-pair-cookie-and-post-data-a-vulnerability
     """
-    return {**request.COOKIES, settings.CSRF_COOKIE_NAME: get_csrf_token(request)}
+    unreserved_cookies = {k: v for k, v in request.COOKIES.items() if not morsel.isReservedKey(k)}
+    return {**unreserved_cookies, settings.CSRF_COOKIE_NAME: get_csrf_token(request)}
 
 
 def _get_nextjs_request_headers(request: HttpRequest, headers: Union[Dict, None] = None):