How-to How to use Django’s CSRF protection

By default, a ‘403 Forbidden’ response is sent to the user if an incoming request fails the checks performed by CsrfViewMiddleware.

Topic guide Working with forms

NOTE: Django ships with an easy-to-use protection against Cross Site > Request Forgeries. When submitting a form via POST with > CSRF protection enabled you must use the csrf_token template tag as > in the preceding example.

Internals Django Deprecation Timeline

See the Django 1.2 release notes for more details on these changes. CsrfResponseMiddleware and CsrfMiddleware will be removed. Use the {% csrf_token %} template tag inside forms to enable CSRF protection. CsrfViewMiddleware remains and is enabled by default.

Tutorial Writing your first Django app, part 4

In short, all POST forms that are targeted at internal URLs should use the {% csrf_token %} template tag. Now, let’s create a Django view that handles the submitted data and does something with it.

Topic guide Templates

Here’s an example of the search algorithm.

Reference Cross Site Request Forgery protection

csrf_exempt(view)[source] : This decorator marks a view as being exempt from the protection ensured by the middleware. Example: csrf_protect(view) : Decorator that provides the protection of CsrfViewMiddleware to a view.

How-to How to implement a custom template backend

Here’s how to implement a custom template backend in order to use another template system. A template backend is a class that inherits django.template.backends.base.BaseEngine. It must implement get_template() and optionally from_string().

Reference Generic editing views

classdjango.views.generic.edit.FormView : A view that displays a form. On error, redisplays the form with validation errors; on success, redirects to a new URL. classdjango.views.generic.edit.BaseFormView : A base view for displaying a form.

Topic guide Asynchronous support

The following decorators can be used with both synchronous and asynchronous view functions: cache_control() never_cache() no_append_slash() csp_override() csp_report_only_override() csrf_exempt() csrf_protect() ensure_csrf_cookie() requires_csrf_token() sensitive_variables() sensitive_post_parameters() gzip_page() condition() conditional_page() etag() last_modified() require_http_methods() require_GET() require_POST() require_safe() vary_on_cookie() vary_on_headers() xframe_options_deny() xframe_options_sameorigin() xframe_options_exempt() For example: …

Topic guide Templates

Tags provide arbitrary logic in the rendering process. This definition is deliberately vague. For example, a tag can output content, serve as a control structure e.g.

Reference Middleware

After UpdateCacheMiddleware: Modifies Vary header. 4. SessionMiddleware Before any middleware that may raise an exception to trigger an error view (such as PermissionDenied) if you’re using CSRF_USE_SESSIONS. After UpdateCacheMiddleware: Modifies Vary header. 5.

Index

… - yesno - template tag - autoescape - block - blocktrans - blocktranslate - cache - comment - csp_nonce_attr - csrf_token - cycle - debug - extends - filter - firstof - for - get_available_languages - get_current_language - get_current_language_bidi - …

Reference Generic editing views

classdjango.views.generic.edit.CreateView : A view that displays a form for creating an object, redisplaying the form with validation errors (if there are any) and saving the object. classdjango.views.generic.edit.BaseCreateView : A base view for creating a new object instance.

Reference Generic editing views

classdjango.views.generic.edit.UpdateView : A view that displays a form for editing an existing object, redisplaying the form with validation errors (if there are any) and saving changes to the object.

Reference Generic editing views

classdjango.views.generic.edit.DeleteView : A view that displays a confirmation page and deletes an existing object. The given object will only be deleted if the request method is POST.

Topic guide Using the Django authentication system

classLogoutView[source] : Logs a user out on POST requests.

Topic guide Time zones

The current time zone is the equivalent of the current locale for translations. However, there’s no equivalent of the Accept-Language HTTP header that Django could use to determine the user’s time zone automatically. Instead, Django provides time zone selection functions.

Topic guide Translation

set_language(request)[source] As a convenience, Django comes with a view, django.views.i18n.set_language(), that sets a user’s language preference and redirects to a given URL or, by default, back to the previous page.

Topic guide Templates

The django.template.loader module defines two functions to load templates. get_template(template_name,using=None)[source] : This function loads the template with the given name and returns a Template object. select_template(template_name_list,using=None)[source] : select_template() is just like get_template(), except it takes a list of template names.

Topic guide Templates

when using render()), the Jinja2 backend adds the globals request, csrf_input, and csrf_token to the context. Apart from that, this backend doesn’t create a Django-flavored environment. It doesn’t know about Django filters and tags.