from django.http import HttpResponseForbidden from django.template import Context, Template from django.conf import settings # We include the template inline since we need to be able to reliably display # this error message, especially for the sake of developers, and there isn't any # other way of making it available independent of what is in the settings file. CSRF_FAILRE_TEMPLATE = """
CSRF verification failed. Request aborted.
{% if DEBUG %}Reason given for failure:
{{ reason }}{% endif %}
In general, this can occur when there is a genuine Cross Site Request Forgery, or when Django's CSRF mechanism has not been used correctly. For POST forms, you need to ensure:
RequestContext
for the template, instead of Context
.{% templatetag openblock %} csrf_token
{% templatetag closeblock %}
template tag inside each POST form that
targets an internal URL.CsrfViewMiddleware
, then you must use
csrf_protect
on any views that use the csrf_token
template tag, as well as those that accept the POST data.You're seeing the help section of this page because you have DEBUG =
True
in your Django settings file. Change that to False
,
and only the initial error message will be displayed.
You can customize this page using the CSRF_FAILURE_VIEW setting.
{% else %}More information is available with DEBUG=True.
{% endif %} """ def csrf_failure(request, reason=""): """ Default view used when request fails CSRF protection """ t = Template(CSRF_FAILRE_TEMPLATE) c = Context({'DEBUG': settings.DEBUG, 'reason': reason}) return HttpResponseForbidden(t.render(c), mimetype='text/html')