djangodocs.org

309 sections across all versions Narrow to Django 6.0 (current) →

Built-in backends

Topic guide Templates Support for template engines

when using render()), the Jinja2 backend adds the globals request, csrf_input, and csrf_token to the context. Apart from that, this backend doesn’t create a Django-flavored environment. It doesn’t know about Django filters and tags.

4.2 5.0 5.1 5.2 6.0

Security

Reference System check framework

security.W003: You don’t appear to be using Django’s built-in cross-site request forgery protection via the middleware (django.middleware.csrf.CsrfViewMiddleware is not in your MIDDLEWARE). Enabling the middleware is the safest approach to ensure you don’t leave any holes.

dev

Security

Reference System check framework Core system checks

security.W003: You don’t appear to be using Django’s built-in cross-site request forgery protection via the middleware (django.middleware.csrf.CsrfViewMiddleware is not in your MIDDLEWARE). Enabling the middleware is the safest approach to ensure you don’t leave any holes.

4.2 5.0 5.1 5.2 6.0

C

Index

… CSP (class in django.utils.csp) - csp() (in module django.template.context_processors) - csp_override() (in module django.views.decorators.csp) - csp_report_only_override() (in module django.views.decorators.csp) - CSRF_COOKIE_AGE - setting - CSRF_COOKIE_DOMAIN - setting - CSRF_COOKIE_HTTPONLY - setting - CSRF_COOKIE_NAME - setting - CSRF_COOKIE_PATH - setting - …

R

Index

… attribute) - required_db_vendor (Options attribute) - REQUIRED_FIELDS (models.CustomUser attribute) - RequireDebugFalse (class in django.utils.log) - RequireDebugTrue (class in django.utils.log) - requires_csrf_token() (in module django.views.decorators.csrf) - requires_migrations_checks (BaseCommand attribute) - requires_system_checks (BaseCommand attribute) - reset_sequences (TransactionTestCase attribute) - reset_url_token (PasswordResetConfirmView attribute) …

CSRF

Release notes Django 1.11 release notes

Added the CSRF_USE_SESSIONS setting to allow storing the CSRF token in the user’s session rather than in a cookie.

dev

CSRF

Release notes Django 1.11 release notes What’s new in Django 1.11Minor features

Added the CSRF_USE_SESSIONS setting to allow storing the CSRF token in the user’s session rather than in a cookie.

4.2 5.0 5.1 5.2 6.0

CSRF response-rewriting middleware

Release notes Django 1.2 release notes

CsrfResponseMiddleware, the middleware that automatically inserted CSRF tokens into POST forms in outgoing pages, has been deprecated in favor of a template tag method (see above), and will be removed completely in Django 1.4.

dev