309 sections across all versions Narrow to Django 6.0 (current) →
Reference The Django template language: for Python programmers Playing with Context objectsBuilt-in template context processors
This processor adds a token that is needed by the csrf_token template tag for protection against Cross Site Request Forgeries. This is always enabled by RequestContext and cannot be disabled. You do not need to include it within context_processors.
How-to How to use Django’s CSRF protection
While the above method can be used for AJAX POST requests, it has some inconveniences: you have to remember to pass the CSRF token in as POST data with every POST request.
How-to How to use Django’s CSRF protection
Django’s Jinja2 template backend adds {{ csrf_input }} to the context of all templates which is equivalent to {% csrf_token %} in the Django template language. For example:
Reference Settings
Default: False Whether to use HttpOnly flag on the CSRF cookie. If this is set to True, client-side JavaScript will not be able to access the CSRF cookie.
How-to How to use Django’s CSRF protection
While the above method can be used for AJAX POST requests, it has some inconveniences: you have to remember to pass the CSRF token in as POST data with every POST request.
How-to How to use Django’s CSRF protection
Django’s Jinja2 template backend adds {{ csrf_input }} to the context of all templates which is equivalent to {% csrf_token %} in the Django template language. For example:
Reference Settings Core Settings
Default: False Whether to use HttpOnly flag on the CSRF cookie. If this is set to True, client-side JavaScript will not be able to access the CSRF cookie.
How-to How to use Django’s CSRF protection
The CsrfViewMiddleware will usually be a big hindrance to testing view functions, due to the need for the CSRF token which must be sent with every POST request.
How-to How to use Django’s CSRF protection
The CsrfViewMiddleware will usually be a big hindrance to testing view functions, due to the need for the CSRF token which must be sent with every POST request.
Reference Cross Site Request Forgery protection
For security reasons, CSRF tokens are rotated each time a user logs in. Any page with a form generated before a login will have an old, invalid CSRF token and need to be reloaded.
Reference Cross Site Request Forgery protection Frequently Asked Questions
For security reasons, CSRF tokens are rotated each time a user logs in. Any page with a form generated before a login will have an old, invalid CSRF token and need to be reloaded.
How-to
To take advantage of CSRF protection in your views, follow these steps: The CSRF middleware is activated by default in the MIDDLEWARE setting.
Reference Cross Site Request Forgery protection
No, this is by design. Not linking CSRF protection to a session allows using the protection on sites such as a pastebin that allow submissions from anonymous users which don’t have a session.
How-to
To take advantage of CSRF protection in your views, follow these steps: The CSRF middleware is activated by default in the MIDDLEWARE setting.
Reference Cross Site Request Forgery protection Frequently Asked Questions
No, this is by design. Not linking CSRF protection to a session allows using the protection on sites such as a pastebin that allow submissions from anonymous users which don’t have a session.
Reference Cross Site Request Forgery protection
The CSRF protection is based on the following things: A CSRF cookie that is a random secret value, which other sites will not have access to. CsrfViewMiddleware sends this cookie with the response whenever django.middleware.csrf.get_token() is called.
Reference Cross Site Request Forgery protection
The CSRF protection is based on the following things: A CSRF cookie that is a random secret value, which other sites will not have access to. CsrfViewMiddleware sends this cookie with the response whenever django.middleware.csrf.get_token() is called.
How-to How to use Django’s CSRF protection
A page makes a POST request via AJAX, and the page does not have an HTML form with a csrf_token that would cause the required CSRF cookie to be sent. Solution: use ensure_csrf_cookie() on the view that sends the page.
How-to How to use Django’s CSRF protection Edge cases
A page makes a POST request via AJAX, and the page does not have an HTML form with a csrf_token that would cause the required CSRF cookie to be sent. Solution: use ensure_csrf_cookie() on the view that sends the page.
How-to How to use Django’s CSRF protection
Rather than adding CsrfViewMiddleware as a blanket protection, you can use the csrf_protect() decorator, which has exactly the same functionality, on particular views that need the protection.