How-to How to use Django’s CSRF protection

Rather than adding CsrfViewMiddleware as a blanket protection, you can use the csrf_protect() decorator, which has exactly the same functionality, on particular views that need the protection.

How-to How to use Django’s CSRF protection

By default, a ‘403 Forbidden’ response is sent to the user if an incoming request fails the checks performed by CsrfViewMiddleware.

Topic guide Working with forms Building a formBuilding a form in Django

NOTE: Django ships with an easy-to-use protection against Cross Site > Request Forgeries. When submitting a form via POST with > CSRF protection enabled you must use the csrf_token template tag as > in the preceding example.

Internals Django Deprecation Timeline

See the Django 1.2 release notes for more details on these changes. CsrfResponseMiddleware and CsrfMiddleware will be removed. Use the {% csrf_token %} template tag inside forms to enable CSRF protection. CsrfViewMiddleware remains and is enabled by default.

dev

Tutorial Writing your first Django app, part 4

In short, all POST forms that are targeted at internal URLs should use the {% csrf_token %} template tag. Now, let’s create a Django view that handles the submitted data and does something with it.

Topic guide Templates Support for template engines

Template objects returned by get_template() and select_template() must provide a render() method with the following signature: Template.render(context=None,request=None) : Renders this template with a given context. Here’s an example of the search algorithm.

Internals Django Deprecation Timeline

See the Django 1.2 release notes for more details on these changes. CsrfResponseMiddleware and CsrfMiddleware will be removed. Use the {% csrf_token %} template tag inside forms to enable CSRF protection. CsrfViewMiddleware remains and is enabled by default.

6.0

Internals Django Deprecation Timeline

The csrf_response_exempt and csrf_view_exempt decorators will be removed. Since 1.4 csrf_response_exempt has been a no-op (it returns the same function), and csrf_view_exempt has been a synonym for django.views.decorators.csrf.csrf_exempt, which should be used to replace it.

5.2 dev

Internals Django Deprecation Timeline

The csrf_response_exempt and csrf_view_exempt decorators will be removed. Since 1.4 csrf_response_exempt has been a no-op (it returns the same function), and csrf_view_exempt has been a synonym for django.views.decorators.csrf.csrf_exempt, which should be used to replace it.

5.0 5.1 6.0 dev

Internals Django Deprecation Timeline

The undocumented check_for_test_cookie method in AuthenticationForm will be removed following an accelerated deprecation. Users subclassing this form should remove calls to this method, and instead ensure that their auth related views are CSRF protected, which ensures that cookies are enabled.

4.2 5.2 6.0

Reference Cross Site Request Forgery protection

csrf_exempt(view)[source] : This decorator marks a view as being exempt from the protection ensured by the middleware. Example: csrf_protect(view) : Decorator that provides the protection of CsrfViewMiddleware to a view.

Topic guide Asynchronous support Async views

The following decorators can be used with both synchronous and asynchronous view functions: cache_control() never_cache() no_append_slash() csp_override() csp_report_only_override() csrf_exempt() csrf_protect() ensure_csrf_cookie() requires_csrf_token() sensitive_variables() sensitive_post_parameters() gzip_page() condition() conditional_page() etag() last_modified() require_http_methods() require_GET() require_POST() require_safe() vary_on_cookie() vary_on_headers() xframe_options_deny() xframe_options_sameorigin() xframe_options_exempt() For example:

5.0 5.1 5.2 6.0 dev

How-to How to implement a custom template backend

Here’s how to implement a custom template backend in order to use another template system. A template backend is a class that inherits django.template.backends.base.BaseEngine. It must implement get_template() and optionally from_string().

Reference Generic editing views

classdjango.views.generic.edit.FormView : A view that displays a form. On error, redisplays the form with validation errors; on success, redirects to a new URL. classdjango.views.generic.edit.BaseFormView : A base view for displaying a form.

Topic guide Templates The Django template languageSyntax

Tags provide arbitrary logic in the rendering process. This definition is deliberately vague. For example, a tag can output content, serve as a control structure e.g.

Reference Middleware

After UpdateCacheMiddleware: Modifies Vary header. 4. SessionMiddleware Before any middleware that may raise an exception to trigger an error view (such as PermissionDenied) if you’re using CSRF_USE_SESSIONS. After UpdateCacheMiddleware: Modifies Vary header. 5.

Index

… - wordwrap - yesno - template tag - autoescape - block - blocktrans - blocktranslate - cache - comment - csrf_token - cycle - debug - extends - filter - firstof - for - get_available_languages - get_current_language - get_current_language_bidi - …

Reference Generic editing views

classdjango.views.generic.edit.CreateView : A view that displays a form for creating an object, redisplaying the form with validation errors (if there are any) and saving the object. classdjango.views.generic.edit.BaseCreateView : A base view for creating a new object instance.

Reference Generic editing views

classdjango.views.generic.edit.UpdateView : A view that displays a form for editing an existing object, redisplaying the form with validation errors (if there are any) and saving changes to the object.

Reference Generic editing views

classdjango.views.generic.edit.DeleteView : A view that displays a confirmation page and deletes an existing object. The given object will only be deleted if the request method is POST.