Django — CSRF

What is CSRF?

CSRF attacks force authenticated users to submit unwanted requests.

CSRF in Templates

<form method="post">
    {% csrf_token %}
    <input type="text" name="data">
    <button type="submit">Submit</button>
</form>

CSRF in AJAX

// Get cookie
function getCookie(name) {
    let cookieValue = null;
    if (document.cookie && document.cookie !== '') {
        const cookies = document.cookie.split(';');
        for (let i = 0; i < cookies.length; i++) {
            const cookie = cookies[i].trim();
            if (cookie.substring(0, name.length + 1) === (name + '=')) {
                cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
                break;
            }
        }
    }
    return cookieValue;
}

// Add to headers
fetch('/api/data', {
    method: 'POST',
    headers: {
        'X-CSRFToken': getCookie('csrftoken'),
        'Content-Type': 'application/json',
    },
    body: JSON.stringify(data)
});

Exempt Views

from django.views.decorators.csrf import csrf_exempt

@csrf_exempt
def my_api_view(request):
    # CSRF not checked
    pass

Settings

CSRF_COOKIE_SECURE = True      # HTTPS only
CSRF_COOKIE_HTTPONLY = True    # JS inaccessible
CSRF_COOKIE_SAMESITE = 'Lax'  # Same-site policy

Mini Practice

1. Add CSRF token to forms
2. Handle CSRF in AJAX requests
3. Exempt a view from CSRF
4. Configure CSRF settings

Up Next

Continue with File Upload — handling file uploads.