from django.http import HttpResponseForbidden from django.template import Context, Template from django.conf import settings # We include the template inline since we need to be able to reliably display # this error message, especially for the sake of developers, and there isn't any # other way of making it available independent of what is in the settings file. CSRF_FAILURE_TEMPLATE = """ 403 Forbidden

Forbidden (403)

CSRF verification failed. Request aborted.

{% if no_referer %}

You are seeing this message because this HTTPS site requires a 'Referer header' to be sent by your Web browser, but none was sent. This header is required for security reasons, to ensure that your browser is not being hijacked by third parties.

If you have configured your browser to disable 'Referer' headers, please re-enable them, at least for this site, or for HTTPS connections, or for 'same-origin' requests.

{% endif %}
{% if DEBUG %}

Help

{% if reason %}

Reason given for failure:

    {{ reason }}
{% endif %}

In general, this can occur when there is a genuine Cross Site Request Forgery, or when Django's CSRF mechanism has not been used correctly. For POST forms, you need to ensure:

You're seeing the help section of this page because you have DEBUG = True in your Django settings file. Change that to False, and only the initial error message will be displayed.

You can customize this page using the CSRF_FAILURE_VIEW setting.

{% else %}

More information is available with DEBUG=True.

{% endif %} """ def csrf_failure(request, reason=""): """ Default view used when request fails CSRF protection """ from django.middleware.csrf import REASON_NO_REFERER t = Template(CSRF_FAILURE_TEMPLATE) c = Context({'DEBUG': settings.DEBUG, 'reason': reason, 'no_referer': reason == REASON_NO_REFERER }) return HttpResponseForbidden(t.render(c), mimetype='text/html')