Stack Overflow
Stack Overflow

Questions tagged [django-csrf]

django-csrf is the Cross Site Request Forgery (CSRF) protection middleware for Django.

The Csrf Middleware for Django modifies outgoing requests that are associated with a session by adding a hidden form field to all 'POST' forms, with name 'csrfmiddlewaretoken' and a value which is a hash of the session ID plus a secret.

The middleware then processes all incoming POST requests that have the session cookie set, checks that the 'csrfmiddlewaretoken' is present and correct, and if it isn't, throws a 403 error.

618 questions
4
votes
0 answers

"CSRF Failed: CSRF cookie not set after" Django upgrade

I've made a Django upgrade from 1.7.5 to 1.11.15. I'm also using Django Rest Framework verion 3.3.2. After this all PUT/POST (probably DELETE too) requests are denied with 403 Status code and message : {"detail":"CSRF Failed: CSRF cookie not…
klaus johan
  • 4,370
  • 10
  • 39
  • 56
4
votes
1 answer

Django in an API like + reactjs. How to generate a csrf token

I did something a bit silly while developing my project: I'm using django only for the admin and the views are used as urls for my front (reactjs) for get actions. I've nothing to protect about the data itself. But the problem is that at some point…
Jay Cee
  • 1,855
  • 5
  • 28
  • 48
4
votes
2 answers

Django: "Forbidden (403) CSRF verification failed. Request aborted." in Docker Production

I am getting this error whenever I am trying to login into Django Admin or Whenever I try to signup in my Django application. I am using Production in Docker and serving site with http. Whatever I know, this problem is arises because of serving it…
Piyush Maurya
  • 1,945
  • 16
  • 26
4
votes
1 answer

How to use csrf_token in django template included with limited context

Django templates allow you to include other templates to compose your page. This is particularly useful when you want to render the entire page, but might want to re-load part of it using AJAX, and don't want to move all render logic into javascript…
SpoonMeiser
  • 19,918
  • 8
  • 50
  • 68
4
votes
2 answers

Nginx + gunicorn Django 1.9 CSRF verification failed

Background : I am trying to configure cloudflare flexible SSL with django. Browser <-HTTPS-> Cloudflare <-HTTP-> Nginx <--> Gunicorn Issue : I am getting CSRF verification failed. Request aborted for admin panel login - For now this is the only POST…
John
  • 41
  • 1
  • 3
4
votes
0 answers

Django csrf_token does not work in Internet Explorer 11

I have very simple login form with csrf token inside. When I submit this form all of data is sent correctly: csrfmiddlewaretoken=GTAf5G5Pg4QsP2IMe02WqWkv1oX6NuqK&login=admin&password=admin There is token, login and password.
Konrad Klimczak
  • 1,474
  • 2
  • 22
  • 44
4
votes
3 answers

What are some examples where programmers might want to use csrf_exempt?

By default, Django offers protection against Cross-Site Request Forgery (CSRF) attacks by sending a CSRF token to webpages it generates, which is then sent back with requests to validate them. This is detailed here. Django provides the csrf_exempt…
Vlad Schnakovszki
  • 8,434
  • 6
  • 80
  • 114
4
votes
1 answer

csrf_token cookie deleted by another site?

I have a django site running on 1.2.1, and once in a while my users lose a lot of work because the csrf_token cookie does not exist and the page errors out with a 403 error on post. I narrowed this down to another site (that my users frequent)…
slypete
  • 5,538
  • 11
  • 47
  • 64
4
votes
1 answer

(Django) CSRF Verification for AJAX requests working in Chrome but not Firefox

As the title states, my (Django) CSRF verification is working in Chrome but not Firefox and I'd like to know why so I can fix this. I have this included in the head tag of my base.html file from which all other files in my application extend:…
Mike Johnson Jr
  • 776
  • 1
  • 13
  • 32
4
votes
1 answer

CSRF verification failed. Request aborted - Django, POST

I'm using Server: Django, Gunicorn, ngnix, postgresql Client: Chrome Advanced Rest Client views.py from django.views.decorators.csrf import csrf_exempt, **ensure_csrf_cookie** # Newly added from django.http import HttpResponse …
tesla
  • 51
  • 1
  • 8
4
votes
1 answer

Django csrf_token is null in chrome

I'm having a bit of a strange problem. I am writing a simple little app and need to post some stuff back to a django view. I'm following the guide here: https://docs.djangoproject.com/en/1.7/ref/contrib/csrf/ to set the ajax headers and have the…
user3908739
  • 449
  • 1
  • 5
  • 13
4
votes
2 answers

Different csrfmiddlewaretoken in form and csrfotken in cookie

I have a simple form in which I am using a csrfmiddlewaretoken in django as:
{% csrf_token %}
On page load both the csrfmiddlewaretoken in form and csrftoken in cookie are same but when I refresh the page using ctrl + F5, the…
Dheeraj batra
  • 51
  • 1
  • 2
4
votes
3 answers

POST with CSRF token to Django Server from iOS

I have an iOS app that needs to login to an existing site that uses Django and requires a CSRF token to login. I cannot change that. My current attempt was to send a GET to the server which would return a CSRF, and then grab that cookie as a string…
marisbest2
  • 1,346
  • 2
  • 17
  • 30
4
votes
1 answer

Caution provisional headers are shown in all browsers only on local machine

I am developing a page. now since today in the morning, i cannot send ajax post calls, and getting this error: Caution provisional headers are shown even if i disable adblock and put all necessary crsf tokens in posts, i am still not able to do…
doniyor
  • 36,596
  • 57
  • 175
  • 260
4
votes
2 answers

Template-less Django + AJAX: Does Django's CSRF token get updated during the course of a browsing session?

My current setup is AngularJS + Django 1.5 and I have completely thrown away the use of Django's template engine (ie. the backend is pretty much an API server). Since I am not using the csrf_token template tag, Django, in turn, does not set and send…
tamakisquare
  • 16,659
  • 26
  • 88
  • 129
1 2 3
…
41 42