Reference Built-in template tags and filters
This tag is used for CSRF protection, as described in the documentation for Cross Site Request Forgeries.
309 sections across all versions Narrow to Django 6.0 (current) →
Reference Built-in template tags and filters Built-in tag reference
This tag is used for CSRF protection, as described in the documentation for Cross Site Request Forgeries.
How-to How to use Django’s CSRF protection
The recommended source for the token is the csrftoken cookie, which will be set if you’ve enabled CSRF protection for your views as outlined above.
How-to How to use Django’s CSRF protection
If you activate CSRF_USE_SESSIONS or CSRF_COOKIE_HTTPONLY, you must include the CSRF token in your HTML and read the token from the DOM with JavaScript:
How-to How to use Django’s CSRF protection Using CSRF protection with AJAX
The recommended source for the token is the csrftoken cookie, which will be set if you’ve enabled CSRF protection for your views as outlined above.
How-to How to use Django’s CSRF protection Using CSRF protection with AJAX
If you activate CSRF_USE_SESSIONS or CSRF_COOKIE_HTTPONLY, you must include the CSRF token in your HTML and read the token from the DOM with JavaScript:
How-to How to use Django’s CSRF protection
There may be some views that are unprotected and have been exempted by csrf_exempt, but still need to include the CSRF token. Solution: use csrf_exempt() followed by requires_csrf_token(). (i.e. requires_csrf_token should be the innermost decorator).
Reference Cross Site Request Forgery protection
No, this is by design. Without a man-in-the-middle attack, there is no way for an attacker to send a CSRF token cookie to a victim’s browser, so a successful attack would need to obtain the victim’s browser’s cookie via XSS …
How-to How to use Django’s CSRF protection Edge cases
There may be some views that are unprotected and have been exempted by csrf_exempt, but still need to include the CSRF token. Solution: use csrf_exempt() followed by requires_csrf_token(). (i.e. requires_csrf_token should be the innermost decorator).
Reference Cross Site Request Forgery protection Frequently Asked Questions
No, this is by design. Without a man-in-the-middle attack, there is no way for an attacker to send a CSRF token cookie to a victim’s browser, so a successful attack would need to obtain the victim’s browser’s cookie via XSS …
How-to How to use Django’s CSRF protection
Finally, you’ll need to set the header on your AJAX request. Using the fetch() API:
How-to How to use Django’s CSRF protection
If the csrf_token template tag is used by a template (or the get_token function is called some other way), CsrfViewMiddleware will add a cookie and a Vary: Cookie header to the response.
How-to How to use Django’s CSRF protection
There are cases when CsrfViewMiddleware.process_view may not have run before your view is run - 404 and 500 handlers, for example - but you still need the CSRF token in a form. Solution: use requires_csrf_token()
Reference Settings
Default: False Whether to store the CSRF token in the user’s session instead of in a cookie. It requires the use of django.contrib.sessions.
How-to How to use Django’s CSRF protection Using CSRF protection with AJAX
Finally, you’ll need to set the header on your AJAX request. Using the fetch() API:
How-to How to use Django’s CSRF protection
If the csrf_token template tag is used by a template (or the get_token function is called some other way), CsrfViewMiddleware will add a cookie and a Vary: Cookie header to the response.
How-to How to use Django’s CSRF protection Edge cases
There are cases when CsrfViewMiddleware.process_view may not have run before your view is run - 404 and 500 handlers, for example - but you still need the CSRF token in a form. Solution: use requires_csrf_token()
Reference Settings Core Settings
Default: False Whether to store the CSRF token in the user’s session instead of in a cookie. It requires the use of django.contrib.sessions.
How-to How to use Django’s CSRF protection
If the csrf_token template tag is used by a template (or the get_token function is called some other way), CsrfViewMiddleware will add a cookie and a Vary: Cookie header to the response.
Reference The Django template language: for Python programmers
This processor adds a token that is needed by the csrf_token template tag for protection against Cross Site Request Forgeries. This is always enabled by RequestContext and cannot be disabled. You do not need to include it within context_processors.