Search code examples
djangopostcsrf

Csrf token verification fails between two Django web applications

I am trying to pass csrf token between two web application to make one POST data to the other. "client" application (C) asks csrf token to "server" application (S) via a GET operation.

S responds to C with a form:

<form id='csrfRequestForm' name='csrfForm' action='http://{{ context_path }}/ajax/getcsrf' method='post'>
  <!-- csrf token -->
  {% csrf_token %}
  <!-- datas to POST follow -->
  ...
</form>

C has to submit this form to action (mapped on a url used by S) in order to POST datas to S. When C tries to do it, csrf verification fails. I've checked GET's result and csrf token is received with the form. I have django.middleware.csrf.CsrfViewMiddleware keyword listed under MIDDLEWARE CLASSES in settings.py and RequestContext is passed when rendering form's view with render_to_response(... RequestContext(request))

What am I doing wrong? Thanks

Solution

  • I wasn't able to resolve it in your way, but I managed out how to do it:

    C go directly to S via javascript opening a popup with:

    window.open("http://<S_address>/<path_to_request_form>");

    In this way, user using C that is logged via a third party authentication server (I forgot to mention it earlier, sorry), is still logged in the popup window in S and receives the form in it with a correct csrf token. I don't know if it's correct but it works. Thanks for your time