Forbidden (403) CSRF verification failed. Request aborted when I hit the submit button

Question

I'm working on the django authentification request and I get the forbidden error I checked my code but it doesn't seem I'm having an error.

HTML

    <div class="grad"></div>
    <div class="header">
    <div>MLAT<span>SI</span></div>
    </div>
    <form action="{{views.login_user}}" method="POST">{% csrf_token %}
    <div class="login">
    <img src="{% static "img/Airplane.png" %}">
    <div id="h" class="home">
    <input type="text" placeholder="Login" name="username" value="">
    <input type="password" placeholder="Mot de passe" name="password" value="">
    <input style="float: left; width: 173px" type="submit" value="Log in" > 
    <input formaction="/form_registration.html/" style="float: right; width: 173px" type="submit" value="Register">

views.py

def login_user(request):
    username = request.POST.get("username")
    password = request.POST.get("password")
    user = authenticate(username=username, password=password)
    if user is not None and user.is_active:
        login(request, user)
        return HttpResponse("You're logged in.")
    else:
        return HttpResponse("Your username and password didn't match.")

Does `{{views.login_user}}` output what you expect it to? I'm also curious why you're defining the form's `action` more than once... — rnevius, May 19 '15 at 10:15
Is the csrf-token rendered into the template? Do you have cookies enabled? — Jingo, May 19 '15 at 10:49
@mevius I'm defining the form's action twice because there's a button that leads to a registration form . — LazyBrain, May 19 '15 at 12:05
@onyeka this is the error traceback : C:\Python34\lib\site-packages\django\template\defaulttags.py:66: UserWarning: A {% csrf_token %} was used in a template, but t he context did not provide the value. This is usually caused by not using RequestContext. — LazyBrain, May 19 '15 at 12:07
You do realize that Django already has forms for logging in users, right? https://github.com/django/django/blob/master/django/contrib/auth/forms.py#L120 — Brandon Taylor, May 19 '15 at 13:04
You should ideally be using django forms. That way, the csrf_tokens are managed for you. — karthikr, May 19 '15 at 14:27

score 2 · Answer 1 · answered May 20 '19 at 21:08

2

you seem like you have a problem in the import package. And the way you're calling the views are incorrect you should read the Django documentation well

answered May 20 '19 at 21:08

nina_z

83
10

score 0 · Accepted Answer · edited May 23 '17 at 12:28

Looks like a duplicate of: Django - {% csrf_token %} was used in a template, but the context did not provide the value

Basically, your login_user view isn't making use of any render/context, hence the error (I don't know if that's the same view that is called when the url for login is called). So Django sees the csrf_token but never converts it to an actual token value.

from django.shortcuts import render

But really both your form and view look very wrong. The form action {{ views.login_user }} is incorrect. You can't call a view that way. And your Register button goes to what looks like an HTML page.

Forbidden (403) CSRF verification failed. Request aborted when I hit the submit button

2 Answers2