Search code examples
djangosecuritycsrf

Django CSRF failure - What are possible causes of failures?

When CSRF is implemented correctly, what are the causes of CSRF failures for normal users (non hackers)?

I think one reason is when cookie is disabled. Are there other probable reasons in their browser/computer settings that can cause the verification to fail?

Thank you.

Solution

  • Cookies being disabled will cause a CSRF failure. The only other potential issue would be said cookie expiring from the time it was issue to when the form was submitted (potentially if the user loaded the form, kept the browser window open for a hours or days and then returned and submitted the form).

    CSRF pretty much just works with a standard form the user got to naturally through navigating the site. AJAX requests can fail if the CSRF token is not passed in the POST data or the X-CSRFToken header isn't sent with the token along with the request. And submissions over HTTPS will fail if not sent from the same domain.