django - With @csrf_exempt still have Set-Cookie: csrftoken -

with django 1.8, not want have cookie set on homepage of site when users not logged in. decorate view @csrf_exempt like

from django.views.decorators.csrf import csrf_exempt  @csrf_exempt  def mainhome(request): 

when @ query can see cookie still set, why ?

rodo@roz-desktop:~/(master)$ curl  -i http://127.0.0.1:8000/ http/1.0 200 ok date: sat, 13 jun 2015 08:59:27 gmt server: wsgiserver/0.1 python/2.7.8 content-type: text/html; charset=utf-8 vary: cookie x-queryinspect-duplicate-sql-queries: 2 x-queryinspect-total-sql-time: 34 ms x-queryinspect-total-request-time: 283 ms x-queryinspect-num-sql-queries: 3 set-cookie:  csrftoken=sa5x0dyxgbamca0d84zznzl2wal0evkv; expires=sat, 11-jun-2016 08:59:27 gmt; max-age=31449600; path=/ 

as @daniel roseman indicated, @csrf_exempt not that.

the middleware responsible session cookie sessionmiddleware. can read more in django docs: how use sessions. unfortunately, there no similar decorator in order exempt specific view.

so in order customize middleware's behaviour, need inherit sessionmiddleware. there nice answer on matter on so.