[Django]-Django {% csrf_token %} or @csrf_protect

You need both. {% csrf_token %} adds hidden fields that is included in POST requests. While @csrf_protect adds a context variable that is used by {% csrf_token %}.