Take the 2-minute tour ×

Django's CSRF protection sets a cookie with the token on response and compares that to the token that is POSTed by the form. It appears in my Facebook Tab app that the csrf cookie is never being set in Safari. I know this has to with Safari's third party cookie policy.

So how are others who are writing Facebook Tab apps or Canvas apps able to set cookies on their app if the user has never visited their domain (which Safari will then allow the setting of the cookie)?

share|improve this question
add comment

Your Answer



Browse other questions tagged or ask your own question.