CSRF Protection in Django

CSRF (Cross-Site Request Forgery) is an attack in which an adversary tricks the user’s browser into sending a request on the user’s behalf.

How Django CSRF Works

1. Django creates a CSRF token when a template renders {% csrf_token %} or a view explicitly requests one
2. Every HTML form with POST must include a hidden field containing the token
3. Django compares the token from the form with the token in the cookie
4. If they do not match — the response is 403 Forbidden

Template Tag

<form method="post">
  {% csrf_token %}
  {{ form.as_p }}
  <button type="submit">Submit</button>
</form>

{% csrf_token %} generates:

<input type="hidden" name="csrfmiddlewaretoken" value="abc123...">

AJAX Requests

// Get the token from the cookie
function getCookie(name) {
    const value = `; ${document.cookie}`;
    const parts = value.split(`; ${name}=`);
    if (parts.length === 2) return parts.pop().split(';').shift();
}

fetch('/api/tasks/', {
    method: 'POST',
    headers: {
        'X-CSRFToken': getCookie('csrftoken'),
        'Content-Type': 'application/json',
    },
    body: JSON.stringify({title: 'New Task'}),
});

Exempting an API Endpoint

from django.views.decorators.csrf import csrf_exempt

@csrf_exempt
def api_endpoint(request):
    ...  # Validate an appropriate non-cookie credential here

Do not add csrf_exempt merely to silence a 403 response. It is appropriate only when the endpoint does not rely on cookie-based authentication and another secure authentication mechanism is enforced. DRF’s SessionAuthentication requires CSRF protection for unsafe methods; token-based authentication does not rely on CSRF tokens.

Middleware

MIDDLEWARE = [
    ...,
    'django.middleware.csrf.CsrfViewMiddleware',
    ...,
]

The middleware is included by default — do not remove it.