166 sections across all versions Narrow to Django 6.0 (current) →
Topic guide
… in a view function Security in Django Always sanitize user input Cross site scripting (XSS) protection Cross site request forgery (CSRF) protection SQL injection protection Clickjacking protection SSL/HTTPS Host header validation Referrer policy Cross-origin opener policy Session security User-uploaded content …
Topic guide Testing tools The test client
By default, the test client will disable any CSRF checks performed by your site. If, for some reason, you want the test client to perform CSRF checks, you can create an instance of the test client that enforces CSRF checks.
Internals Django Deprecation Timeline
The CSRF_COOKIE_MASKED transitional setting will be removed. The name argument of django.utils.functional.cached_property() will be removed. The opclasses argument of django.contrib.postgres.constraints.ExclusionConstraint will be removed. The undocumented ability to pass errors=None to SimpleTestCase.assertFormError() and assertFormsetError() will be removed. django.contrib.sessions.serializers.PickleSerializer will be removed.
Internals Django Deprecation Timeline
The CSRF_COOKIE_MASKED transitional setting will be removed. The name argument of django.utils.functional.cached_property() will be removed. The opclasses argument of django.contrib.postgres.constraints.ExclusionConstraint will be removed. The undocumented ability to pass errors=None to SimpleTestCase.assertFormError() and assertFormsetError() will be removed. django.contrib.sessions.serializers.PickleSerializer will be removed.
Internals Django Deprecation Timeline
The CSRF_COOKIE_MASKED transitional setting will be removed. The name argument of django.utils.functional.cached_property() will be removed. The opclasses argument of django.contrib.postgres.constraints.ExclusionConstraint will be removed. The undocumented ability to pass errors=None to SimpleTestCase.assertFormError() and assertFormsetError() will be removed. django.contrib.sessions.serializers.PickleSerializer will be removed.
Internals Django Deprecation Timeline
The CSRF_COOKIE_MASKED transitional setting will be removed. The name argument of django.utils.functional.cached_property() will be removed. The opclasses argument of django.contrib.postgres.constraints.ExclusionConstraint will be removed. The undocumented ability to pass errors=None to SimpleTestCase.assertFormError() and assertFormsetError() will be removed. django.contrib.sessions.serializers.PickleSerializer will be removed.
Internals Django Deprecation Timeline
The undocumented check_for_test_cookie method in AuthenticationForm will be removed following an accelerated deprecation. Users subclassing this form should remove calls to this method, and instead ensure that their auth related views are CSRF protected, which ensures that cookies are enabled.
… in a view function Security in Django Always sanitize user input Cross site scripting (XSS) protection Cross site request forgery (CSRF) protection SQL injection protection Clickjacking protection SSL/HTTPS Host header validation Referrer policy Cross-origin opener policy Session security User-uploaded content …
… django.middleware - module - django.middleware.cache - module - django.middleware.clickjacking - module - django.middleware.common - module - django.middleware.csp - module - django.middleware.csrf - module - django.middleware.gzip - module - django.middleware.http - module - django.middleware.locale - module - django.middleware.security - module - …
… django.forms.formsets - django.forms.models - django.forms.renderers - django.forms.widgets - django.http - django.middleware - django.middleware.cache - django.middleware.clickjacking - django.middleware.common - django.middleware.csp - django.middleware.csrf - django.middleware.gzip - django.middleware.http - django.middleware.locale - django.middleware.security - django.shortcuts - django.tasks - django.tasks.backends.base - django.tasks.backends.dummy - django.tasks.backends.immediate - …
… CACHES - CACHES-BACKEND - CACHES-KEY_FUNCTION - CACHES-KEY_PREFIX - CACHES-LOCATION - CACHES-OPTIONS - CACHES-TIMEOUT - CACHES-VERSION - CONN_HEALTH_CHECKS - CONN_MAX_AGE - CSRF_COOKIE_AGE - CSRF_COOKIE_DOMAIN - CSRF_COOKIE_HTTPONLY - CSRF_COOKIE_NAME - CSRF_COOKIE_PATH - CSRF_COOKIE_SAMESITE - CSRF_COOKIE_SECURE - CSRF_FAILURE_VIEW - CSRF_HEADER_NAME - CSRF_TRUSTED_ORIGINS - …
| | | django.middleware.csp | Middleware for Content Security Policy headers | | | django.middleware.csrf | Protects against Cross Site Request Forgeries | | | django.middleware.gzip | Middleware to serve GZipped content for performance.
How-to How to use Django’s CSRF protection
Certain views can have unusual requirements that mean they don’t fit the normal pattern envisaged here. A number of utilities can be useful in these situations. The scenarios they might be needed in are described in the following section.
Release notes Django 1.9 release notes What’s new in Django 1.9Minor features
The request header’s name used for CSRF authentication can be customized with CSRF_HEADER_NAME. The CSRF referer header is now validated against the CSRF_COOKIE_DOMAIN setting if set. See How it works for details.
Release notes Django 2.1 release notes What’s new in Django 2.1Minor features
Added the CSRF_COOKIE_SAMESITE setting to set the SameSite cookie flag on CSRF cookies.
Release notes Django 3.1 release notes What’s new in Django 3.1Minor features
The CSRF_COOKIE_SAMESITE setting now allows 'None' (string) value to explicitly state that the cookie is sent with all same-site and cross-site requests.
Release notes Django 4.0 release notes What’s new in Django 4.0Minor features
CSRF protection now consults the Origin header, if present. To facilitate this, some changes to the CSRF_TRUSTED_ORIGINS setting are required.
Release notes Django 6.2 release notes - UNDER DEVELOPMENT What’s new in Django 6.2Minor features
…
Release notes Django 1.3 release notes Backwards-incompatible changes in 1.3
Prior to Django 1.2.5, Django’s CSRF-prevention system exempted AJAX requests from CSRF verification; due to security issues reported to us, however, all requests are now subjected to CSRF verification.
Release notes Django 1.4 release notes What’s new in Django 1.4
We’ve made various improvements to our CSRF features, including the ensure_csrf_cookie() decorator, which can help with AJAX-heavy sites; protection for PUT and DELETE requests; and the CSRF_COOKIE_SECURE and CSRF_COOKIE_PATH settings, which can improve the security and usefulness of CSRF protection.