309 sections across all versions Narrow to Django 6.0 (current) →
Release notes Django 1.5.2 release notes
The CSRF token now rotates when a user logs in. Some Python 3 compatibility fixes including #20212 and #20025. Fixed some rare cases where get() exceptions recursed infinitely (#20278). makemessages no longer crashes with UnicodeDecodeError (#20354).
Release notes Django 4.1 release notes Features deprecated in 4.1
CsrfViewMiddleware no longer masks the CSRF cookie like it does the CSRF token in the DOM. CsrfViewMiddleware now uses request.META['CSRF_COOKIE'] for storing the unmasked CSRF secret rather than a masked version. This is an undocumented, private API.
Release notes Django 4.1 release notes Features deprecated in 4.1
Logging out via GET requests to the built-in logout view is deprecated. Use POST requests instead.
Release notes Django 1.5 release notes
The csrf_token template tag is no longer enclosed in a div. If you need HTML validation against pre-HTML5 Strict DTDs, you should add a div around it in your pages.
Release notes Django 1.5 release notes Backwards incompatible changes in 1.5
The csrf_token template tag is no longer enclosed in a div. If you need HTML validation against pre-HTML5 Strict DTDs, you should add a div around it in your pages.
Reference Settings
Default: 'csrftoken' The name of the cookie to use for the CSRF authentication token. This can be whatever you want (as long as it’s different from the other cookie names in your application). See Cross Site Request Forgery protection.
Reference Settings Core Settings
Default: 'csrftoken' The name of the cookie to use for the CSRF authentication token. This can be whatever you want (as long as it’s different from the other cookie names in your application). See Cross Site Request Forgery protection.
Reference Settings
Default: 'HTTP_X_CSRFTOKEN' The name of the request header used for CSRF authentication.
Reference Settings Core Settings
Default: 'HTTP_X_CSRFTOKEN' The name of the request header used for CSRF authentication.
Reference Cross Site Request Forgery protection
Subdomains within a site will be able to set cookies on the client for the whole domain. By setting the cookie and using a corresponding token, subdomains will be able to circumvent the CSRF protection.
Reference Cross Site Request Forgery protection
Subdomains within a site will be able to set cookies on the client for the whole domain. By setting the cookie and using a corresponding token, subdomains will be able to circumvent the CSRF protection.
Release notes Django 1.10 release notes
The default CSRF_FAILURE_VIEW, views.csrf.csrf_failure() now accepts an optional template_name parameter, defaulting to '403_csrf.html', to control the template used to render the page.
Release notes Django 1.10 release notes What’s new in Django 1.10Minor features
The default CSRF_FAILURE_VIEW, views.csrf.csrf_failure() now accepts an optional template_name parameter, defaulting to '403_csrf.html', to control the template used to render the page.
Release notes Django 1.9.2 release notes
Fixed a crash when destroying an existing test database on MySQL or PostgreSQL (#26096). Fixed CSRF cookie check on POST requests when USE_X_FORWARDED_PORT=True (#26094). Fixed a QuerySet.order_by() crash when ordering by a relational field of a ManyToManyField through model (#26092).
Release notes Django 1.9.2 release notes
Fixed a crash when destroying an existing test database on MySQL or PostgreSQL (#26096). Fixed CSRF cookie check on POST requests when USE_X_FORWARDED_PORT=True (#26094). Fixed a QuerySet.order_by() crash when ordering by a relational field of a ManyToManyField through model (#26092).
How-to How to use Django’s CSRF protection
Because it is possible for the developer to turn off the CsrfViewMiddleware, all relevant views in contrib apps use the csrf_protect decorator to ensure the security of these applications against CSRF.
How-to Deployment checklist
Set this to True to avoid transmitting the CSRF cookie over HTTP accidentally.
Reference Middleware
classCsrfViewMiddleware[source] : Adds protection against Cross Site Request Forgeries by adding hidden form fields to POST forms and checking requests for the correct value. See the Cross Site Request Forgery protection documentation.
Reference Settings
Default: 31449600 (approximately 1 year, in seconds) The age of CSRF cookies, in seconds.
Reference Settings
Default: None The domain to be used when setting the CSRF cookie. This can be useful for easily allowing cross-subdomain requests to be excluded from the normal cross site request forgery protection.