from django.http import HttpResponseForbidden from django.template import Context, Template from django.conf import settings # We include the template inline since we need to be able to reliably display # this error message, especially for the sake of developers, and there isn't any # other way of making it available independent of what is in the settings file. CSRF_FAILRE_TEMPLATE = """ 403 Forbidden

403 Forbidden

CSRF verification failed. Request aborted.

{% if DEBUG %}

Help

{% if reason %}

Reason given for failure:

    {{ reason }}

{% endif %}

In general, this can occur when there is a genuine Cross Site Request Forgery, or when Django's CSRF mechanism has not been used correctly. For POST forms, you need to ensure:

The view function uses RequestContext for the template, instead of Context.
In the template, there is a {% templatetag openblock %} csrf_token {% templatetag closeblock %} template tag inside each POST form that targets an internal URL.

You're seeing the help section of this page because you have DEBUG = True in your Django settings file. Change that to False, and only the initial error message will be displayed.

You can customize this page using the CSRF_FAILURE_VIEW setting.

{% endif %} """ def csrf_failure(request, reason=""): """ Default view used when request fails CSRF protection """ t = Template(CSRF_FAILRE_TEMPLATE) c = Context({'DEBUG': settings.DEBUG, 'reason': reason}) return HttpResponseForbidden(t.render(c), mimetype='text/html')