4

I have a simple form in which I am using a csrfmiddlewaretoken in django as: 

<form>
{% csrf_token %}
</form>

On page load both the csrfmiddlewaretoken in form and csrftoken in cookie are same but when I refresh the page using ctrl + F5, the csrftoken in cookie changes but the csrfmiddlewaretoken in the form remains same, which leads to the future POST AJAX request fail.

What can be the reason of this ?

Dheeraj batra
  • 51
  • 1
  • 2

2 Answers2

2

I think your Django version is 1.10 or 1.11, because after 1.9, there are some news in csrf.

To protect against BREACH attacks, the CSRF protection mechanism now changes the form token value on every request (while keeping an invariant secret which can be used to validate the different tokens).

doc link

L. Sparks
  • 21
  • 2
0
  • Are you using cache?
  • Have you tried to add @csrf_protect decorator to your method responsible for generating HTML?
  • Are you doing any manual manipulation with csrf token in your views?

Some code snippets of your views and forms would be useful, it's wild guessing without them.

Dariusz Aniszewski
  • 457
  • 2
  • 9