diff --git a/django_nextjs/render.py b/django_nextjs/render.py index c042acc..0690c43 100644 --- a/django_nextjs/render.py +++ b/django_nextjs/render.py @@ -1,4 +1,5 @@ import warnings +from http.cookies import Morsel from typing import Dict, Tuple, Union from urllib.parse import quote @@ -13,6 +14,8 @@ from .app_settings import NEXTJS_SERVER_URL from .utils import filter_mapping_obj +morsel = Morsel() + def _get_render_context(html: str, extra_context: Union[Dict, None] = None): a = html.find("") @@ -46,7 +49,8 @@ def _get_nextjs_request_cookies(request: HttpRequest): (i.e. dont use HTTP unsafe methods or GraphQL mutations). https://docs.djangoproject.com/en/3.2/ref/csrf/#is-posting-an-arbitrary-csrf-token-pair-cookie-and-post-data-a-vulnerability """ - return {**request.COOKIES, settings.CSRF_COOKIE_NAME: get_csrf_token(request)} + unreserved_cookies = {k: v for k, v in request.COOKIES.items() if not morsel.isReservedKey(k)} + return {**unreserved_cookies, settings.CSRF_COOKIE_NAME: get_csrf_token(request)} def _get_nextjs_request_headers(request: HttpRequest, headers: Union[Dict, None] = None):