Search code examples
pythondjangocsrfdjango-csrf

How does Django 1.4 CSRF work?


I have that urls.py:

from django.conf.urls import patterns, url

urlpatterns = patterns('',
    url(
        r'^login/$', 
        'django.contrib.auth.views.login', 
        {'template_name': 'loyalty/login.html'}, 
        name='login'
    ),
    url(
        r'^logout/$', 
        'django.contrib.auth.views.logout', 
        {'next_page': '/', },
        name='logout'),
)

and have template login.html*:

{% extends "loyalty/auth.html" %}
  {% load i18n %}  

  {% block auth_form %}
  {% if messages %}
  <ul>
    {% for message in messages %}
    <li>{{ message }}</li>
    {% endfor %}
  </ul>
  {% endif %}

  <form action="" method="post" id="login-form">{% csrf_token %}
    {% if form.username.errors %}{{ form.username.errors }}{% endif %}
    {{ form.username }}
    {% if form.password.errors %}{{ form.password.errors }}{% endif %}
    {{ form.password }}
    <input type="hidden" name="this_is_the_login_form" value="1" />
    <input type="hidden" name="next" value="{{ next }}" />
    <button type="submit" name="submit">{% trans 'Log in' %}</button>
  </form>
  {% endblock %}

and i have in settings.py:

MIDDLEWARE_CLASSES = (
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.locale.LocaleMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    # Uncomment the next line for simple clickjacking protection:
    # 'django.middleware.clickjacking.XFrameOptionsMiddleware',
)

But this gives me this error:

Forbidden (403)
CSRF verification failed. Request aborted.
Help
Reason given for failure:
CSRF cookie not set.

In administrative interface, I have same problem.

What can I do to solve this problem?


Solution

  • I solved this problem. Problem in browser. Tried an other browser and all works fine. Didn't understand why I had this problem, because I tried clean cache and cookies.