Question

I'm getting a CSRF verification failed message when trying to make a simple form from a tutorial. I did a little research into what CSRF verification actually is, and to my knowledge, in order to use it you need one of those csrf_token tags in your html, but I don't have that

Here's my template:

<form action="/testapp1/contact/" method="post">
    {{ form.as_p }}
    <input type="submit" value="Submit" />
</form>

Fairly straightforward, located at contact.html

Here's my urlconf: from django.conf.urls.defaults import *

urlpatterns=patterns('testapp1.views',
    (r'^$', 'index'),
    (r'^contact/$','contact')
)

The app name is testapp1. When I type my url (http://localhost:8000/testapp1/contact), I correctly go to the form. Then when I submit the form, I get the verification error.

Here's my view although I don't think it's relevant:

def contact(request):
    if request.method == 'POST': # If the form has been submitted...
        form = ContactForm(request.POST) # A form bound to the POST data
        if form.is_valid(): # All validation rules pass
            subject = form.cleaned_data['subject']
            message = form.cleaned_data['message']
            sender = form.cleaned_data['sender']
            cc_myself = form.cleaned_data['cc_myself']
            recipients = ['[[email protected]](/cdn-cgi/l/email-protection)']
            if cc_myself:
                recipients.append(sender)
            print 'Sending Mail:'+subject+','+message+','+sender+','+recipients
            return HttpResponseRedirect('/thanks/') # Redirect after POST
    else:
        form = ContactForm() # An unbound form

    return render_to_response('contact.html', {
        'form': form,
    })

Answer

The fix

1. include {% csrf_token %} inside the form tag in the template.

2. if for any reason you are using render_to_response on Django 1.3 and above replace it with the render function. Replace this:

# Don't use this on Django 1.3 and above
return render_to_response('contact.html', {'form': form})

With this:

return render(request, 'contact.html', {form: form})

The render function was introduced in Django version 1.3 - if you are using an ancient version [like 1.2 or below](http://django.readthedocs.io/en/1.2.X/topics/http/shortcuts.html#render- to-response) you must use render_to_response with a a RequestContext:

# Deprecated since version 2.0
return render_to_response('contact.html', {'form': form},
                   context_instance=RequestContext(request))

What is CSRF protection and why would I want it?

It is an attack where an enemy can force your users to do nasty things like transferring funds, changing their email address, and so forth:

Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application. Source: [The Open Web Application Security Project](https://www.owasp.org/index.php/Cross- Site_Request_Forgery_(CSRF))

Even if you don't care about this kind of thing now the application may grow so the best practice is to keep CSRF protection on.

Should not CSRF protection be optional?

It is optional but turned on by default (the CSRF middleware is included by default). You can turn it off:

• for a particular view by decorating it with the csrf_exempt decorator.
• for every view by removing the CSRF middleware from the middleware list at settings.py

If you turn it off system-wide you can turn it on for a particular view by decorating it with the csrf_protect decorator.