Reference Settings

Default: '/' The path set on the CSRF cookie. This should either match the URL path of your Django installation or be a parent of that path.

dev

Reference Settings

Default: 'Lax' The value of the SameSite flag on the CSRF cookie. This flag prevents the cookie from being sent in cross-site requests. See SESSION_COOKIE_SAMESITE for details about SameSite.

dev

Reference Settings

Default: False Whether to use a secure cookie for the CSRF cookie. If this is set to True, the cookie will be marked as “secure”, which means browsers may ensure that the cookie is only sent with an HTTPS connection.

dev

Reference Settings

Default: 'django.views.csrf.csrf_failure' A dotted path to the view function to be used when an incoming request is rejected by the CSRF protection.

dev

Reference Settings

Default: [] (Empty list) A list of trusted origins for unsafe requests (e.g. POST). For requests that include the Origin header, Django’s CSRF protection requires that header match the origin present in the Host header.

dev

How-to How to use Django’s CSRF protection

Because it is possible for the developer to turn off the CsrfViewMiddleware, all relevant views in contrib apps use the csrf_protect decorator to ensure the security of these applications against CSRF.

4.2 5.0 5.1 5.2 6.0

How-to Deployment checklist HTTPS

Set this to True to avoid transmitting the CSRF cookie over HTTP accidentally.

4.2 5.0 5.1 5.2 6.0

Reference Middleware Available middleware

classCsrfViewMiddleware[source] Adds protection against Cross Site Request Forgeries by adding hidden form fields to POST forms and checking requests for the correct value. See the Cross Site Request Forgery protection documentation.

4.2 5.0 5.1 5.2 6.0

Reference Settings Core Settings

Default: 31449600 (approximately 1 year, in seconds) The age of CSRF cookies, in seconds.

4.2 5.0 5.1 5.2 6.0

Reference Settings Core Settings

Default: None The domain to be used when setting the CSRF cookie. This can be useful for easily allowing cross-subdomain requests to be excluded from the normal cross site request forgery protection.

4.2 5.0 5.1 5.2 6.0

Reference Settings Core Settings

Default: '/' The path set on the CSRF cookie. This should either match the URL path of your Django installation or be a parent of that path.

4.2 5.0 5.1 5.2 6.0

Reference Settings Core Settings

Default: 'Lax' The value of the SameSite flag on the CSRF cookie. This flag prevents the cookie from being sent in cross-site requests. See SESSION_COOKIE_SAMESITE for details about SameSite.

4.2 5.0 5.1 5.2 6.0

Reference Settings Core Settings

Default: False Whether to use a secure cookie for the CSRF cookie. If this is set to True, the cookie will be marked as “secure”, which means browsers may ensure that the cookie is only sent with an HTTPS connection.

4.2 5.0 5.1 5.2 6.0

Reference Settings Core Settings

Default: 'django.views.csrf.csrf_failure' A dotted path to the view function to be used when an incoming request is rejected by the CSRF protection.

4.2 5.0 5.1 5.2 6.0

Reference Settings Core Settings

Default: [] (Empty list) A list of trusted origins for unsafe requests (e.g. POST). For requests that include the Origin header, Django’s CSRF protection requires that header match the origin present in the Host header.

4.2 5.0 5.1 5.2 6.0

Reference Settings Core Settings

New in Django 4.1. Default: False Whether to mask the CSRF cookie. See release notes for usage details. WARNING: Deprecated since version 4.1: This transitional setting is deprecated and will be removed in Django 5.0.

4.2

How-to How to use Django’s CSRF protection

Most views requires CSRF protection, but a few do not. Solution: rather than disabling the middleware and applying csrf_protect to all the views that need it, enable the middleware and use csrf_exempt().

dev

How-to How to use Django’s CSRF protection Edge cases

Most views requires CSRF protection, but a few do not. Solution: rather than disabling the middleware and applying csrf_protect to all the views that need it, enable the middleware and use csrf_exempt().

4.2 5.0 5.1 5.2 6.0

Topic guide Security in Django

CSRF attacks allow a malicious user to execute actions using the credentials of another user without that user’s knowledge or consent. Django has built-in protection against most types of CSRF attacks, providing you have enabled and used it where appropriate.

dev

Topic guide Security in Django

CSRF attacks allow a malicious user to execute actions using the credentials of another user without that user’s knowledge or consent. Django has built-in protection against most types of CSRF attacks, providing you have enabled and used it where appropriate.

4.2 5.0 5.1 5.2 6.0