How can I check my website is currently protect against csrf?

Question

I am working on a dJango web and follow the tutorial to protect it against CSRF, I did something and not sure is it write now install or not, how can I see or check it?

Answer 1

From the docs, to enable CSRF protection for your views, follow these steps:

1. Add the middleware 'django.middleware.csrf.CsrfViewMiddleware' to your list of middleware classes, MIDDLEWARE_CLASSES in your settings.py. (It should come before any view middleware that assume that CSRF attacks have been dealt with.)

2. In any template that uses a POST form, use the csrf_token tag inside the element if the form is for an internal URL, e.g.:

   <form action="." method="post">{% csrf_token %}
   

3. In the corresponding view functions, ensure that the 'django.core.context_processors.csrf' context processor is being used.

Following these steps will check that CSRF tokens are included properly.

By default, a ‘403 Forbidden’ response is sent to the user if an incoming request fails the checks performed by CsrfViewMiddleware. This should usually only be seen when there is a genuine Cross Site Request Forgery, or when, due to a programming error, the CSRF token has not been included with a POST form.

See the Docs for more info.