Django CSRF token authentication failing

Question

I'm trying to write a webpage that allows user to input an "Idea" and save it to the database. I want to use the Post method of the form. I tried following the instructions on the django page, but the authentication still fails.

This is my form code:

<form action="/" method="post">
   {% csrf_token %} 
   <p> Title: </p>  <input type="text" name="title"> </br>  
   <p> Details: </p> <input type="text" name="details"> 
   <input type="submit" value="Post"> 
</form>

My URLconf redirects / to Ideas.views.home with the line

url(r'^$', 'Ideas.views.home' , name='home')

The view itself is

from django.shortcuts import render, render_to_response
from django.http import HttpResponse
from django.template import loader, Template, Context, RequestContext   
from django.core.context_processors import csrf 
from Ideas.models import Idea 


# Create your views here.
def home(request):
    if request.method == 'POST': 
        submitted = Idea.objects.create(title=request.POST['title'], detail=request.POST['details'], votes=0) 
        submitted.save()
    m = RequestContext(request, {"passed_ideas": Idea.objects.all()})
    return render_to_response('basic.html', m)

I have also tried doing this:

from django.shortcuts import render, render_to_response
from django.http import HttpResponse
from django.template import loader, Template, Context, RequestContext   
from django.core.context_processors import csrf 
from Ideas.models import Idea 


# Create your views here.
def home(request):
    c = {} 
    c.update(csrf(request)) 
    if request.method == 'POST': 
        submitted = Idea.objects.create(title=request.POST['title'], detail=request.POST['details'], votes=0) 
        submitted.save()
    c['passed_ideas'] = Idea.objects.all()
    return render_to_response('basic.html', c)

How do I get the CSRF authentication to work?

try @csrf_exempt decorator to your view, this eliminates csrf token validation, if it works, you can dig more... — MartinM, Aug 27 '14 at 18:42
@MartinM Thanks, at least I can continue development for now! — elder4222, Aug 27 '14 at 18:52

Chris Belyeu · Answer 1 · 2014-08-27T18:51:31.017

0

I had a similar problem a few weeks back. It seems that redirecting to the url with '/' causes it to drop the CSRF token. If that is the problem, add trailing_slash=False to your router:

# urls.py
router = DefaultRouter(trailing_slash=False)

urlpatterns = patterns('', 
    url(r'^$', views.IndexView.as_view(), name='home'),
    #all of your urls go here
)

This will eliminate the redirect, and the CSRF token should come through.

edited Aug 27 '14 at 18:51

answered Aug 27 '14 at 18:43

Chris Belyeu

208
1
9

sorry, i'm a Django n00b. Is that in the settings.py file? – elder4222 Aug 27 '14 at 18:45
for mine, its in the urls.py. It looks like this: router = DefaultRouter(trailing_slash=False) urlpatterns = patterns('', ...) – Chris Belyeu Aug 27 '14 at 18:47

score 0 · Answer 2 · answered Aug 27 '14 at 18:45

0

I think you need to add context_instance=RequestContext(request) when you render your template in order to process your csrf token

 return render_to_response('basic.html', c, context_instance=RequestContext(request))

answered Aug 27 '14 at 18:45

klasske

2,164
1
24
31

is that when i'm using the second code i put up (with c.update(crsf(request))) – elder4222 Aug 27 '14 at 19:00
Yes, and you can remove `c.update(csrf(request))` from that one. – klasske Aug 27 '14 at 19:06

score 0 · Answer 3 · answered Aug 27 '14 at 19:15

0

Thanks everyone who helped, but switching from

return render_to_response(...)

to

return render(request, ...)

finally fixed it

answered Aug 27 '14 at 19:15

elder4222

355
2
15

after this, I found a similar (although not the exact same) post here: http://stackoverflow.com/questions/10388033/csrf-verification-failed-request-aborted?rq=1 – elder4222 Aug 27 '14 at 19:17

score 0 · Accepted Answer · answered Aug 29 '14 at 16:51

Yes, you have to use render, or you have to add crsf to the render to response like so:

render_to_response('basic.html', add_csrf(request, ***other context***))


from django.core.context_processors import csrf
def add_csrf(request, ** kwargs):
   """Add CSRF and user to dictionary."""
   d = dict(user=request.user, ** kwargs)
   d.update(csrf(request))
   return d

Not that I like this option, but this is how I did it. I think the RequestContext is a better option.

Django CSRF token authentication failing

4 Answers4