Release notes

This release corrects the following problems: The patch applied for the security issue covered in Django 1.2.2 caused issues with non-ASCII responses using CSRF tokens.

Release notes Django 1.1.2 release notes

Django 1.2 (the next major release of Django) will contain a feature that will improve protection against Cross-Site Request Forgery (CSRF) attacks. This feature requires the use of a new csrf_token template tag in all forms that Django renders.

Release notes Django 1.11.6 release notes

Fixed a regression in Django 1.9 where a custom view error handler such as handler404 that accesses csrf_token could cause CSRF verification failures on other pages (#28488).

Release notes Django 1.5.2 release notes

The CSRF token now rotates when a user logs in. Some Python 3 compatibility fixes including #20212 and #20025. Fixed some rare cases where get() exceptions recursed infinitely (#20278). makemessages no longer crashes with UnicodeDecodeError (#20354).

Release notes Django 4.1 release notes Features deprecated in 4.1

CsrfViewMiddleware no longer masks the CSRF cookie like it does the CSRF token in the DOM. CsrfViewMiddleware now uses request.META['CSRF_COOKIE'] for storing the unmasked CSRF secret rather than a masked version. This is an undocumented, private API.

Release notes Django 4.1 release notes Features deprecated in 4.1

Logging out via GET requests to the built-in logout view is deprecated. Use POST requests instead.

Release notes Django 1.5 release notes Backwards incompatible changes in 1.5

The csrf_token template tag is no longer enclosed in a div. If you need HTML validation against pre-HTML5 Strict DTDs, you should add a div around it in your pages.

Reference Settings Core Settings

Default: 'csrftoken' The name of the cookie to use for the CSRF authentication token. This can be whatever you want (as long as it’s different from the other cookie names in your application). See Cross Site Request Forgery protection.

Reference Settings Core Settings

Default: 'HTTP_X_CSRFTOKEN' The name of the request header used for CSRF authentication.

Reference Cross Site Request Forgery protection

Subdomains within a site will be able to set cookies on the client for the whole domain. By setting the cookie and using a corresponding token, subdomains will be able to circumvent the CSRF protection.

Release notes Django 1.10 release notes What’s new in Django 1.10Minor features

The default CSRF_FAILURE_VIEW, views.csrf.csrf_failure() now accepts an optional template_name parameter, defaulting to '403_csrf.html', to control the template used to render the page.

Release notes Django 1.9.2 release notes

Fixed a crash when destroying an existing test database on MySQL or PostgreSQL (#26096). Fixed CSRF cookie check on POST requests when USE_X_FORWARDED_PORT=True (#26094). Fixed a QuerySet.order_by() crash when ordering by a relational field of a ManyToManyField through model (#26092).

How-to How to use Django’s CSRF protection

Because it is possible for the developer to turn off the CsrfViewMiddleware, all relevant views in contrib apps use the csrf_protect decorator to ensure the security of these applications against CSRF.

How-to Deployment checklist HTTPS

Set this to True to avoid transmitting the CSRF cookie over HTTP accidentally.

Reference Middleware Available middleware

classCsrfViewMiddleware[source] Adds protection against Cross Site Request Forgeries by adding hidden form fields to POST forms and checking requests for the correct value. See the Cross Site Request Forgery protection documentation.

Reference Settings Core Settings

Default: 31449600 (approximately 1 year, in seconds) The age of CSRF cookies, in seconds.

Reference Settings Core Settings

Default: None The domain to be used when setting the CSRF cookie. This can be useful for easily allowing cross-subdomain requests to be excluded from the normal cross site request forgery protection.

Reference Settings Core Settings

Default: '/' The path set on the CSRF cookie. This should either match the URL path of your Django installation or be a parent of that path.

Reference Settings Core Settings

Default: 'Lax' The value of the SameSite flag on the CSRF cookie. This flag prevents the cookie from being sent in cross-site requests. See SESSION_COOKIE_SAMESITE for details about SameSite.

Reference Settings Core Settings

Default: False Whether to use a secure cookie for the CSRF cookie. If this is set to True, the cookie will be marked as “secure”, which means browsers may ensure that the cookie is only sent with an HTTPS connection.