How-to How to use Django’s CSRF protection

By default, a ‘403 Forbidden’ response is sent to the user if an incoming request fails the checks performed by CsrfViewMiddleware.

Topic guide Working with forms Building a formBuilding a form in Django

NOTE: Django ships with an easy-to-use protection against Cross Site Request > Forgeries. When submitting a form via POST with > CSRF protection enabled you must use the csrf_token template tag > as in the preceding example.

Internals Django Deprecation Timeline

See the Django 1.2 release notes for more details on these changes. CsrfResponseMiddleware and CsrfMiddleware will be removed. Use the {% csrf_token %} template tag inside forms to enable CSRF protection. CsrfViewMiddleware remains and is enabled by default.

Tutorial Writing your first Django app, part 4

In short, all POST forms that are targeted at internal URLs should use the {% csrf_token %} template tag. Now, let’s create a Django view that handles the submitted data and does something with it.

Reference Cross Site Request Forgery protection

csrf_exempt(view)[source] : This decorator marks a view as being exempt from the protection ensured by the middleware. Example: csrf_protect(view) : Decorator that provides the protection of CsrfViewMiddleware to a view.

Topic guide Asynchronous support Async views

The following decorators can be used with both synchronous and asynchronous view functions: cache_control() never_cache() no_append_slash() csrf_exempt() csrf_protect() ensure_csrf_cookie() requires_csrf_token() sensitive_variables() sensitive_post_parameters() gzip_page() condition() conditional_page() etag() last_modified() require_http_methods() require_GET() require_POST() require_safe() vary_on_cookie() vary_on_headers() xframe_options_deny() xframe_options_sameorigin() xframe_options_exempt() For example:

How-to How to implement a custom template backend

Here’s how to implement a custom template backend in order to use another template system. A template backend is a class that inherits django.template.backends.base.BaseEngine. It must implement get_template() and optionally from_string().

Reference Generic editing views

classdjango.views.generic.edit.FormView : A view that displays a form. On error, redisplays the form with validation errors; on success, redirects to a new URL. classdjango.views.generic.edit.BaseFormView : A base view for displaying a form.

Topic guide Templates The Django template languageSyntax

Tags provide arbitrary logic in the rendering process. This definition is deliberately vague. For example, a tag can output content, serve as a control structure e.g.

Reference Middleware

After UpdateCacheMiddleware: Modifies Vary header. 4. SessionMiddleware Before any middleware that may raise an exception to trigger an error view (such as PermissionDenied) if you’re using CSRF_USE_SESSIONS. After UpdateCacheMiddleware: Modifies Vary header. 5.

Index

… - wordwrap - yesno - template tag - autoescape - block - blocktrans - blocktranslate - cache - comment - csrf_token - cycle - debug - extends - filter - firstof - for - get_available_languages - get_current_language - get_current_language_bidi - …

Reference Generic editing views

classdjango.views.generic.edit.CreateView : A view that displays a form for creating an object, redisplaying the form with validation errors (if there are any) and saving the object. classdjango.views.generic.edit.BaseCreateView : A base view for creating a new object instance.

Reference Generic editing views

classdjango.views.generic.edit.UpdateView : A view that displays a form for editing an existing object, redisplaying the form with validation errors (if there are any) and saving changes to the object.

Reference Generic editing views

classdjango.views.generic.edit.DeleteView : A view that displays a confirmation page and deletes an existing object. The given object will only be deleted if the request method is POST.

Topic guide Using the Django authentication system Authentication in web requestsAuthentication Views

classLogoutView[source] : Logs a user out on POST requests.

Topic guide Time zones Concepts

The current time zone is the equivalent of the current locale for translations. However, there’s no equivalent of the Accept-Language HTTP header that Django could use to determine the user’s time zone automatically. Instead, Django provides time zone selection functions.

Topic guide Translation Miscellaneous

set_language(request)[source] As a convenience, Django comes with a view, django.views.i18n.set_language(), that sets a user’s language preference and redirects to a given URL or, by default, back to the previous page.

Topic guide Templates Support for template engines

The django.template.loader module defines two functions to load templates. get_template(template_name,using=None)[source] : This function loads the template with the given name and returns a Template object. select_template(template_name_list,using=None)[source] : select_template() is just like get_template(), except it takes a list of template names.

Topic guide Templates Support for template engines

when using render()), the Jinja2 backend adds the globals request, csrf_input, and csrf_token to the context. Apart from that, this backend doesn’t create a Django-flavored environment. It doesn’t know about Django filters and tags.

Reference System check framework Core system checks

security.W003: You don’t appear to be using Django’s built-in cross-site request forgery protection via the middleware (django.middleware.csrf.CsrfViewMiddleware is not in your MIDDLEWARE). Enabling the middleware is the safest approach to ensure you don’t leave any holes.