Geek Answers Handbook

Django: CSRF check failed even after adding {% csrf_token%}

views.py:

def index(request): return render_to_response('index.html', {}) def photos(request, artist): if not artist: return render_to_response('photos.html', {'error' : 'no artist supplied'}) photos = get_photos_for_artist(artist) if not photos: logging.error('Issue while getting photos for artist') return render_to_response('photos.html', {'error': 'no matching artist found'}) return render_to_response('photos.html', {'photos': photos})

Index.html:

 <html> <head> <title>find artist photos </title> </head> <body> {% block error %} {% endblock %} <form action="/photos" method="POST"> {% csrf_token %} <label for="artist">Artist : </label> <input type="text" name="artist"> <input type="submit" value="Search"> </form> {% block content %}{% endblock %} </body> </html>

photos.html:

 {% extends 'index.html' %} {% block error %} {% if error %} <p> {{ error}} </p> {% endif %} {% endblock %} {% block content %} {% if photos %} {% for photo in photos %} {{ photo }} {% endfor %} {% endif %} {% endblock%}

url.py:

 urlpatterns = patterns('', (r'', index), (r'^time/$', current_datetime), (r'^photos/(\w+)$', photos) )

I even tried adding {% csrf_token %} , but no luck

thanks

UPDATE
I see them in magazines

 UserWarning: A {% csrf_token %} was used in a template, but the context did not provide the value. This is usually caused by not using RequestContext. warnings.warn("A {% csrf_token %} was used in a template, but the context did not provide the value. This is usually caused by not using RequestContext.")

This happened after adding context_instance = RequestContext (request) ** for render_to_response () **

+3
source share
7 answers

add context_instance=RequestContext(request) to each view in which you will use the form inside it:

 return render_to_response('index.html', {}, context_instance=RequestContext(request) ) return render_to_response('photos.html', {'photos': photos}, context_instance=RequestContext(request) )
+9
source

Assuming you are using a fairly new version of Django (1.3 / 1.4 / dev), you should follow these steps:

  • In settings.py add the django.middleware.csrf.CsrfViewMiddleware to MIDDLEWARE_CLASSES .
  • In the template, use {% crsf_token %} on the form.
  • In your opinion, make sure that the django.core.context_processors.csrf context django.core.context_processors.csrf used either:
    • use RequestContext from django.template
    • directly import csrf processor from from django.core.context_processors

Examples

 from django.template import RequestContext from django.shortcuts import render_to_response def my_view(request): return render_to_response('my_template.html', {}, context_instance=RequestContext(request))

or

 from django.core.context_processors import csrf from django.shortcuts import render_to_response def my_view(request): c = {csrf(request)} return render_to_response('my_template.html', c)

References

(comprehensive post for posterity and future viewers)

+5
source

The following are some troubleshooting steps:

  • Upload your index page in a web browser, do a Source View and see if {% csrf_token %} expands. It should be replaced with the <input> . If this does not happen, you are having problems with your index page. If it is replaced correctly, you are having problems with the photo page.

  • The POST URL in index.html does not match any of the patterns in urls.py Your urls.py seems to expect the search request to be part of the URL, but it isn’t - you are sending it as an HTTP POST parameter. You need to access it through request.POST .

+3
source

Check the settings if you have this middleware:

 'django.middleware.csrf.CsrfViewMiddleware'

https://docs.djangoproject.com/en/dev/ref/contrib/csrf/

+2
source

You may need to explicitly pass an instance of RequestContext when you use render_to_response to get the CSRF values ​​for this template tag.

http://lincolnloop.com/blog/2008/may/10/getting-requestcontext-your-templates/

+1
source

Try using the @csrf_protect decorator:

 from django.views.decorators.csrf import csrf_protect from django.shortcuts import render_to_response @csrf_protect def photos(request,artist): if not artist: return render_to_response('photos.html', {'error' : 'no artist supplied'}) photos = get_photos_for_artist(artist) if not photos: logging.error('Issue while getting photos for artist') return render_to_response('photos.html', {'error': 'no matching artist found'}) return render_to_response('photos.html', {'photos': photos})
0
source

This worked for me:

{% csrf_token%} In the template within each POST form, there is a template tag {% csrf_token%} that targets the internal URL.

In views.py:

from django.template import RequestContext

...

...

...

return render_to_response ("home.html", {}, context_instance = RequestContext (request) )

-one
source

More articles:


All Articles