CSRF verification failed despite following documentation

Question

I'm trying to implement an ajax function that will execute a database query based on the id value of a drop down selection.

The HTML of the drop down list is

<form method = "POST" action="" >{% csrf_token %}
  <select name = "parentorgs" id = "parentorgs">
    {% for org in parentorg_list %}
      <option value = "{{org.parentorg}}" id = "{{org.parentorg}}" >{{ org.parentorgname }}</option>
    {% endfor %}
  </select>
</form>

A jQuery change() function is used to get the ID of the selection and passes it to

function getData(id) {
  $.ajax({
    type : "POST",
    url : "getData/",
    data : {"parentorg" : id},
    datatype: "json",
    success : function(data) {
      console.log(data)
}
  });
}

which in turn calls the view function

from django.shortcuts import render_to_response, render
from django.core.context_processors import csrf

def getData(request):
  c = {}
  c.update(csrf(request))
  return render_to_response("app/index.html", c)

Firebug shows that the request is going through via POST, and the method URL is valid. In addition, the URL of this method has been added to urls.py.

At this time, its not doing anything, as I just want to see the response from the method. This method is intended to execute a model query and return the results.

Each time an item is selected in the dropdown, I get an error 403 describing that the view uses ResponseContext rather than Context for the template.

What needs to be done to resolve this issue?

@VictorCastilloTorres, I get `[19/Jun/2013 21:28:11] "POST /app/getData/ HTTP/1.1" 403 2294`, when it should be `parentorg : 28` — Jason, Jun 20 '13 at 02:29
Do you have js code that sets the header on your Ajax queries ? https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#ajax — Andrei Kaigorodov, Jun 20 '13 at 02:30
@AndreyKaygorodov, I don't. I'm manually importing and using the processor to generate the CSRF token. In Firebug's Cookies tab, I can see a csrftoken being sent. — Jason, Jun 20 '13 at 02:32
You have to set the header on your Ajax as the comment above, also read this (https://docs.djangoproject.com/en/1.4/ref/templates/api/#playing-with-context-objects) and try to change this and see what happens `from django.template import RequestContext` `return render_to_response("app/index.html", c, context_instance=RequestContext(request))` — Victor Castillo Torres, Jun 20 '13 at 02:34
According to the doc `While the above method can be used for AJAX POST requests, it has some inconveniences: you have to remember to pass the CSRF token in as POST data with every POST request.` am passing in the token with every request. From the wording, it sounds as if the header setting is a convenient alternative but not required. — Jason, Jun 20 '13 at 02:36
I updated my comment plase read it again and try to do it :D — Victor Castillo Torres, Jun 20 '13 at 02:37

score 1 · Accepted Answer · answered Jun 20 '13 at 02:54

According to the doc

If you’re using Django’s render_to_response() shortcut to populate a template with the contents of a dictionary, your template will be passed a Context instance by default (not a RequestContext). To use a RequestContext in your template rendering, pass an optional third argument to render_to_response(): a RequestContext instance. Your code might look like this:

from django.template import RequestContext 
def getData(request):
  c = {}
  c.update(csrf(request))
  return render_to_response("app/index.html", c, context_instance=RequestContext(request))

CSRF verification failed despite following documentation

1 Answers1