CSRF Token missing or incorrect

Question

Beginner at Django here, I've been trying to fix this for a long time now. I do have 'django.middleware.csrf.CsrfViewMiddleware' in my middleware classes and I do have the token in my post form.

Heres my code, what am I doing wrong?

from django.contrib.auth.forms import UserCreationForm
from django.shortcuts import render_to_response
from django.http import HttpResponseRedirect
from chartsey.authentication.forms import RegistrationForm
from django.template import RequestContext
from django.core.context_processors import csrf

def register(request):

    if request.method == 'POST':
        c = RequestContext(request.POST, {})
        form = RegistrationForm(c)
        if form.is_valid():
            new_user = form.save()
            return HttpResponseRedirect("/")
    else:
        form = RegistrationForm()

    return render_to_response("register.html",  {'form': form,  }, )

Here's my Template:

{% block content %}

    <h1>Register</h1>
    <form action="" method="POST"> {% csrf_token %}
        {{ form.as_p }}
    <input type="submit" value="Submit">
    </form>

{% endblock %}

possible duplicate of [Django: CSRF token missing or incorrect](http://stackoverflow.com/questions/8321217/django-csrf-token-missing-or-incorrect) — lracicot, Sep 16 '13 at 21:46
This article solved my issue: https://stackoverflow.com/a/20895547/14690597 — Divinity, Feb 11 '22 at 20:57
This article solved my issue: https://stackoverflow.com/a/20895547/14690597 — Divinity, Feb 11 '22 at 21:08

score 30 · Accepted Answer · edited Jun 20 '20 at 09:12

30

Update: This answer is from 2011. CSRF is easy today.

These days you should be using the render shortcut function return render(request, 'template.html') which uses RequestContext automatically so the advice below is outdated by 8 years.

Use render https://docs.djangoproject.com/en/2.2/topics/http/shortcuts/
Add CSRF middleware https://docs.djangoproject.com/en/2.2/ref/csrf/
Use the {% csrf_token %} template tag
Confirm you see the CSRF token value being generated, AND submitted in your form request

Original Response

My guess is that you have the tag in the template but it's not rendering anything (or did you mean you confirmed in the actual HTML that a CSRF token is being generated?)

Either use RequestContext instead of a dictionary

render_to_response("foo.html", RequestContext(request, {}))

Or make sure you have django.core.context_processors.csrf in your CONTEXT_PROCESSORS setting.

https://docs.djangoproject.com/en/dev/ref/contrib/csrf/

Or add the token to your context manually

edited Jun 20 '20 at 09:12

Community

1
1

answered Nov 11 '11 at 03:49

Yuji 'Tomita' Tomita

115,817
29
282
245

That did it! I'm still having a little trouble fully understanding it, but at least I'm past staring blankly and trying to randomly change things. The docs didn't help me too much, thanks so much! – aroooo Nov 11 '11 at 04:32
This is step 3 in the docs :) Django's docs are amazing if you let yourself dig in a little bit. Good luck! – Yuji 'Tomita' Tomita Nov 11 '11 at 09:36
Thank you very much, this solved my problem. General advice for everyone: check if you user render_to_response() with the proper parameters, I messed up and given it 3 parameters, therefore it resulted in the above error. – Phonebox Jul 07 '15 at 14:37

score 6 · Answer 2 · edited Nov 06 '12 at 09:46

6

Just add this to your views

return render_to_response("register.html", {'form': form, }, context_instance = RequestContext(request))

It will work!!

edited Nov 06 '12 at 09:46

TRR

1,637
2
26
43

answered Nov 06 '12 at 09:23

Njogu Mbau

446
1
7
14

score 4 · Answer 3 · edited May 23 '17 at 12:02

4

Try using render instead of render_to_response:

from django.shortcuts import render

render(request, "foo.html", {})

Django - what is the difference between render(), render_to_response() and direct_to_template()?

As stated in the link above it was introduced in Django 1.3 and automatically uses RequestContext

edited May 23 '17 at 12:02

Community

1
1

answered Aug 07 '16 at 23:46

Kamen Tsvetkov

519
5
9

score 1 · Answer 4 · answered May 08 '20 at 06:54

for Django version 3.0 add the below annotation

@csrf_protect
def yourfunc(request):
    return render(request, '../your.html', None)

And don't forget add the below tag in your field

<form action="add/" method="post">
  {% csrf_token %}
...
</form>

score 0 · Answer 5 · answered Jan 17 '13 at 14:35

0

If you are not using CsrfViewMiddleware, then you must use csrf_protect on any views that use the csrf_token template tag, as well as those that accept the POST data.

answered Jan 17 '13 at 14:35

Neeraj Sharma

1,322
10
9

score 0 · Answer 6 · edited May 23 '17 at 12:17

The addition of RequestContext is the key when using render_to_response as mentioned by @Yuji 'Tomita' Tomita and @Njogu Mbau. However, what initially threw me off when I was struggling with this problem was that I had to add RequestContext to both the function in views.py that initially loads the template and to the function in views.py that handles the submission from the template.

Also, just for reference, here are some other links that discuss this same problem

score 0 · Answer 7 · answered Dec 29 '16 at 05:54

0

Also got this error randomly on some pages after I installed django-livereload-server. Uninstalling django-livereload-server did the trick.

answered Dec 29 '16 at 05:54

lukeaus

11,465
7
50
60

score 0 · Answer 8 · answered Jul 03 '20 at 20:57

I had this issue too, but honestly, I hit refresh on my browser a few minutes later without changing anything and it worked that time. I had this message in my command line as so it might provide a clue as to what was causing the issue:

Not Found: /css/reset/reset.css
[03/Jul/2020 20:52:13] "GET /css/reset/reset.css HTTP/......

score 0 · Answer 9 · answered Aug 10 '21 at 12:03

DJANGO/AJAX WORKFLOW FULL METHOD IS HERE :)

const url = "{% url 'YOUR_URL_NAME' pk=12345 %}".replace(/12345/, id.toString());
$.ajax({
        type: 'POST',
        url: url,
        data: {'id':id, "csrfmiddlewaretoken": '{{csrf_token}}'},
        beforeSend: function() { $('#response').text('Please wait ...'); },
        success: function (response) {
            console.log(response)           
        },
        error: function (response) {
            console.log(response)
        }
    })

Hope It Will Work !!!

score -1 · Answer 10 · answered May 31 '17 at 20:24

-1

What worked for me was commenting out the below line from my settings.py

'django.middleware.csrf.CsrfViewMiddleware'

answered May 31 '17 at 20:24

Laughing Horse

158
10

4

This just removes CSRF protection entirely; it doesn't address the actual problem. – Micah Walter Dec 28 '18 at 22:04

CSRF Token missing or incorrect

10 Answers10

Update: This answer is from 2011. CSRF is easy today.

Original Response

DJANGO/AJAX WORKFLOW FULL METHOD IS HERE :)

Linked