# Deprecation/Removal: Csrf CrossDomainCookieMiddleware (DEPR-165)

**URL:** <https://discuss.openedx.org/t/deprecation-removal-csrf-crossdomaincookiemiddleware-depr-165/5710>\
**Category:** Deprecation\
**Created:** [September 1, 2021, 7:28pm UTC](https://discuss.openedx.org/t/deprecation-removal-csrf-crossdomaincookiemiddleware-depr-165/5710 "2021-09-01T19:28:46Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![jill](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/jill/32/3188_2.png) [@jill](https://discuss.openedx.org/u/jill)\
**Post date:** [September 2, 2021, 1:50am UTC](https://discuss.openedx.org/t/deprecation-removal-csrf-crossdomaincookiemiddleware-depr-165/5710/2 "2021-09-02T01:50:07Z")

</div>

Hi @jinder_Singh , thanks for the announcement!

But we use [cross-domain CSRF for SAML authentication to Okta](https://discuss.openedx.org/t/cross-origin-resource-sharing-error-preflight-missing-allow-origin-header/5663/2#open-edx-site-configuration-2), and we have another client that uses it for logging in from their custom frontend (albeit on an old version of Open edX, and there may be better APIs for this now CC @itsjeyd ).

Instead of removing this middleware entirely, could it be moved to a plugin so that users who need it can still use it?

---

_[View the full topic](https://discuss.openedx.org/t/deprecation-removal-csrf-crossdomaincookiemiddleware-depr-165/5710)._