Django - CSRF verification failed

Question

I'm getting a CSRF verification failed message when trying to make a simple form from a tutorial. I did a little research into what CSRF verification actually is, and to my knowledge, in order to use it you need one of those csrf_token tags in your html, but I don't have that

Here's my template:

<form action="/testapp1/contact/" method="post">
 {{ form.as_p }}
 <input type="submit" value="Submit" />
</form>

Fairly straightforward, located at contact.html

Here's my urlconf: from django.conf.urls.defaults import *

urlpatterns=patterns('testapp1.views',
 (r'^$', 'index'),
 (r'^contact/$','contact')
)

The app name is testapp1. When I type my url (http://localhost:8000/testapp1/contact), I correctly go to the form. Then when I submit the form, I get the verification error.

Here's my view although I don't think it's relevant:

def contact(request):
 if request.method == 'POST': # If the form has been submitted...
 form = ContactForm(request.POST) # A form bound to the POST data
 if form.is_valid(): # All validation rules pass
 subject = form.cleaned_data['subject']
 message = form.cleaned_data['message']
 sender = form.cleaned_data['sender']
 cc_myself = form.cleaned_data['cc_myself']
 recipients = ['[email protected]']
 if cc_myself:
 recipients.append(sender)
 print 'Sending Mail:'+subject+','+message+','+sender+','+recipients
 return HttpResponseRedirect('/thanks/') # Redirect after POST
 else:
 form = ContactForm() # An unbound form
 return render_to_response('contact.html', {
 'form': form,
 })

Answer 1

The fix

1. include {% csrf_token %} inside the form tag in the template.

2. if for any reason you are using render_to_response on Django 1.3 and above replace it with the render function. Replace this:

# Don't use this on Django 1.3 and above
return render_to_response('contact.html', {'form': form})

With this:

return render(request, 'contact.html', {form: form})

The render function was introduced in Django version 1.3 - if you are using an ancient version like 1.2 or below you must use render_to_response with a a RequestContext:

# Deprecated since version 2.0
return render_to_response('contact.html', {'form': form},
 context_instance=RequestContext(request))

What is CSRF protection and why would I want it?

It is an attack where an enemy can force your users to do nasty things like transferring funds, changing their email address, and so forth:

Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application. Source: The Open Web Application Security Project

Even if you don't care about this kind of thing now the application may grow so the best practice is to keep CSRF protection on.

Should not CSRF protection be optional?

It is optional but turned on by default (the CSRF middleware is included by default). You can turn it off:

• for a particular view by decorating it with the csrf_exempt decorator.
• for every view by removing the CSRF middleware from the middleware list at settings.py

If you turn it off system-wide you can turn it on for a particular view by decorating it with the csrf_protect decorator.

• JPC: Ya I had just gotten it to work doing that. I guess I thought that CSRF protection was optional. Apparently if you submit a form you NEED to use CSRF or it won't work. Oh well. Thanks
• Wolph: @JPC: it depends on your configuration. If you use the CSRF middleware than it's required unless you use the csrf_excempt decorator. If you don't use it than it's not required unless you use the csrf_protect decorator.
• northben: you'll also need to import from django.template import RequestContext

Answer 2

views.py:

from django.shortcuts import render_to_response
from django.template import RequestContext
def my_view(request):
 return render_to_response('mytemplate.html', context_instance=RequestContext(request)) 

mytemlate.html:

<form action="/someurls/" method="POST">{% csrf_token %}

Answer 3

For Django 1.4

settings.py

MIDDLEWARE_CLASSES = (
...
'django.middleware.csrf.CsrfViewMiddleware',
)

view.py

from django.template.defaulttags import csrf_token
from django.shortcuts import render
@csrf_token
def home(request):
 """home page"""
 return render(request,
 'template.html',
 {}
 )

template.html

<form action="">
 {% csrf_token %}
....
</form>

Answer 4

This may be caused by problems with your TLS or SSL configuration

If you're loading the URL over https:// , Django checks that the CSRF token's scheme matches the expected scheme. Sometimes, Django does not detect correctly when https:// has been used. You can check for yourself by including this in your template:

 is_secure: {{ request.is_secure }}

or by calling request.is_secure() in your Python code.

If the page has been loaded over https:// , then is_secure() should return True, and if not, it should return False.