CSRF verification failed despite following documentation

Question

I'm trying to implement an ajax function that will execute a database query based on the id value of a drop down selection.

The HTML of the drop down list is

<form method = "POST" action="" >{% csrf_token %}
 <select name = "parentorgs" id = "parentorgs">
 {% for org in parentorg_list %}
 <option value = "{{org.parentorg}}" id = "{{org.parentorg}}" >{{ org.parentorgname }}</option>
 {% endfor %}
 </select>
</form>

A jQuery change() function is used to get the ID of the selection and passes it to

function getData(id) {
 $.ajax({
 type : "POST",
 url : "getData/",
 data : {"parentorg" : id},
 datatype: "json",
 success : function(data) {
 console.log(data)
}
 });
}

which in turn calls the view function

from django.shortcuts import render_to_response, render
from django.core.context_processors import csrf
def getData(request):
 c = {}
 c.update(csrf(request))
 return render_to_response("app/index.html", c)

Firebug shows that the request is going through via POST, and the method URL is valid. In addition, the URL of this method has been added to urls.py.

At this time, its not doing anything, as I just want to see the response from the method. This method is intended to execute a model query and return the results.

Each time an item is selected in the dropdown, I get an error 403 describing that the view uses ResponseContext rather than Context for the template.

What needs to be done to resolve this issue?

• Victor Castillo Torres: what happens if you put in your code print request.POST ?
• Jason: @VictorCastilloTorres, I get [19/Jun/2013 21:28:11] "POST /app/getData/ HTTP/1.1" 403 2294, when it should be parentorg : 28
• Andrei Kaigorodov: Do you have js code that sets the header on your Ajax queries ? docs.djangoproject.com/en/dev/ref/contrib/csrf/#ajax
• Victor Castillo Torres: You have to set the header on your Ajax as the comment above, also read this (docs.djangoproject.com/en/1.4/ref/templates/api/…) and try to change this and see what happens from django.template import RequestContext return render_to_response("app/index.html", c, context_instance=RequestContext(request))
• Victor Castillo Torres: I updated my comment plase read it again and try to do it :D

Answer 1

According to the doc

If you’re using Django’s render_to_response() shortcut to populate a template with the contents of a dictionary, your template will be passed a Context instance by default (not a RequestContext). To use a RequestContext in your template rendering, pass an optional third argument to render_to_response(): a RequestContext instance. Your code might look like this:

from django.template import RequestContext 
def getData(request):
 c = {}
 c.update(csrf(request))
 return render_to_response("app/index.html", c, context_instance=RequestContext(request))