CSRF Cookie Behavior in Django

Based on the Django documentation, the behavior you're experiencing is expected. The CSRF token cookie is not automatically set on all views unless certain conditions are met.

Why the CSRF Cookie Might Not Appear

According to the documentation, Django might not set the CSRF token cookie if your view is not rendering a template containing the {% csrf_token %} template tag. This is specifically mentioned in the warning:

If your view is not rendering a template containing the csrf_token template tag, Django might not set the CSRF token cookie. This is common in cases where forms are dynamically added to the page.

This explains why you're not seeing the cookie in your new Django 3.0.8 project.

Solutions to Ensure the CSRF Cookie is Set

There are several ways to ensure the CSRF cookie is set:

1. Use the ensure_csrf_cookie decorator: This is the recommended approach for views that don't naturally include the CSRF token in their templates:

   PYTHONCopied
   from django.views.decorators.csrf import ensure_csrf_cookie
   
   @ensure_csrf_cookie
   def my_view(request):
       return render(request, 'template.html')

2. Include {% csrf_token %} in your template: If your view renders a template, make sure it includes the CSRF token tag, even if you don't have a form:

   HTMLCopied
   {% csrf_token %}
   <!-- Rest of your template -->

3. For class-based views, you can use the decorator with method_decorator:

   PYTHONCopied
   from django.utils.decorators import method_decorator
   from django.views.decorators.csrf import ensure_csrf_cookie
   from django.views.generic import TemplateView
   
   @method_decorator(ensure_csrf_cookie, name='dispatch')
   class MyView(TemplateView):
       template_name = 'template.html'

For AJAX Requests

For AJAX requests specifically, if you're following the method in the documentation but still not seeing the cookie, you should:

1. Make sure at least one view that's loaded before your AJAX request either includes the {% csrf_token %} tag or uses the @ensure_csrf_cookie decorator.

2. If you're using CSRF_USE_SESSIONS or CSRF_COOKIE_HTTPONLY settings set to True, you'll need to get the token from the DOM rather than from cookies.

This behavior is by design in Django to optimize performance by not setting cookies unnecessarily.