# Code maintenance OP-20714 - Separate CSRF cookie from sessions

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-20714

## OPEN POINTS

_No work packages_

## Subtasks

_No work packages_

## Details

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Designer |  |
| Developers | Oliver Günther |
| Requires doc change | No |
| Date |  |
| Priority | Medium |
| Target versions | 18.0.0 |
| Sprint |  |
| Backlog bucket |  |
| Module | DevSecOps / Security, Authentication |
| Accessibility | No |
| List |  |

## Estimates and progress

| Attribute | Value |
| --- | --- |
| Work |  |
| Remaining work |  |

## Description

Anonymous requests result in a new session cookie on every visit due to at least the CSRF token. We can separate CSRF and session cookies, so that most anonymous requests will no longer write to the sessions table