[Django]-Django – CSRF verification failed

by

41👍

✅

The fix

1. include {% csrf_token %} inside the form tag in the template.

2. if for any reason you are using render_to_response on Django 1.3 and above replace it with the render function. Replace this:

# Don't use this on Django 1.3 and above
return render_to_response('contact.html', {'form': form})

With this:

return render(request, 'contact.html', {form: form})

The render function was introduced in Django version 1.3 – if you are using an ancient version like 1.2 or below you must use render_to_response with a a RequestContext:

# Deprecated since version 2.0
return render_to_response('contact.html', {'form': form},
                   context_instance=RequestContext(request))

What is CSRF protection and why would I want it?

It is an attack where an enemy can force your users to do nasty things like transferring funds, changing their email address, and so forth:

Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker’s choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application. Source: The Open Web Application Security Project

Even if you don’t care about this kind of thing now the application may grow so the best practice is to keep CSRF protection on.

Should not CSRF protection be optional?

It is optional but turned on by default (the CSRF middleware is included by default). You can turn it off:

  • for a particular view by decorating it with the csrf_exempt decorator.
  • for every view by removing the CSRF middleware from the middleware list at settings.py

If you turn it off system-wide you can turn it on for a particular view by decorating it with the csrf_protect decorator.

👤Paulo Scardine

3👍

views.py:

from django.shortcuts import render_to_response
from django.template import RequestContext

def my_view(request):
    return render_to_response('mytemplate.html', context_instance=RequestContext(request))

mytemlate.html:

<form action="/someurls/" method="POST">{% csrf_token %}
👤hustljian

2👍

For Django 1.4

settings.py

MIDDLEWARE_CLASSES = (
...
'django.middleware.csrf.CsrfViewMiddleware',
)

view.py

from django.template.defaulttags import csrf_token
from django.shortcuts import render

@csrf_token
def home(request):
    """home page"""
    return render(request,
        'template.html',
            {}
    )

template.html

<form action="">
    {% csrf_token %}
....
</form>
👤b1_

Leave a comment