CSRF protection mechanism in Django - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a Django view lacks CSRF token validation?

Consider a Django view that processes POST requests but does not include CSRF token validation. What is the expected behavior when a POST request is made without a valid CSRF token?

Django

from django.views.decorators.csrf import csrf_exempt
from django.http import HttpResponse

@csrf_exempt
def my_view(request):
    if request.method == 'POST':
        return HttpResponse('POST received')
    return HttpResponse('Hello')

A The POST request is processed normally without any CSRF error.

B Django raises a 403 Forbidden error due to missing CSRF token.

C The server crashes with a server error (500).

D The POST request is redirected to the login page.

💡 Hint

Think about what the @csrf_exempt decorator does.

The @csrf_exempt decorator disables CSRF protection for the decorated view. Therefore, POST requests without a CSRF token are accepted and processed normally.

📝 Syntax

intermediate

Which template code correctly includes the CSRF token in a Django form?

You want to protect a form in a Django template from CSRF attacks. Which of the following template snippets correctly includes the CSRF token?

Django

<form method="post">
  <!-- CSRF token goes here -->
  <input type="text" name="username">
  <button type="submit">Submit</button>
</form>

A {% csrf_token %}{{ csrf_token }}

B {{ csrf_token }}

C {% csrf_token %}

D <input type="hidden" name="csrfmiddlewaretoken" value="{{ csrf_token }}">

💡 Hint

Django uses a special template tag to insert the CSRF token.

The correct way to include the CSRF token in a Django template form is using the {% csrf_token %} template tag. It inserts a hidden input with the token automatically.

🔧 Debug

advanced

Why does this Django view raise a CSRF verification failed error?

Examine the following Django view and template. The POST request raises a CSRF verification failed error. What is the cause?

Django

views.py:
from django.shortcuts import render
from django.views.decorators.csrf import csrf_protect

@csrf_protect
def submit_view(request):
    if request.method == 'POST':
        return render(request, 'success.html')
    return render(request, 'form.html')

form.html:
<form method="post">
  <input type="text" name="data">
  <button type="submit">Send</button>
</form>

A The CSRF middleware is disabled in settings.py.

B The view should use @csrf_exempt instead of @csrf_protect.

C The form method should be GET instead of POST.

D The template is missing the {% csrf_token %} tag inside the form.

💡 Hint

Check the form template for CSRF token inclusion.

The CSRF protection requires the token to be included in the form. The template lacks {% csrf_token %}, so Django rejects the POST request.

🧠 Conceptual

advanced

How does Django's CSRF protection mechanism verify POST requests?

Which of the following best describes how Django verifies that a POST request is safe from CSRF attacks?

A It compares the CSRF token in the POST data with a token stored in a cookie sent to the client.

B It verifies that the request comes from the same IP address as the server.

C It requires the user to enter a CAPTCHA on every POST request.

D It checks that the CSRF token in the POST data matches the token stored in the user's session cookie.

💡 Hint

Think about where Django stores the CSRF token on the client side.

Django stores a CSRF token in a cookie and expects the same token to be sent in the POST data. It compares these tokens to verify the request.

❓ state_output

expert

What is the value of the CSRF cookie after a GET request to a Django view with CSRF protection enabled?

A user visits a Django view protected by CSRF middleware with a GET request. What will be the state of the CSRF cookie in the browser after this request?

Django

from django.shortcuts import render

def my_view(request):
    return render(request, 'page.html')

A The CSRF cookie is deleted by the server.

B The CSRF cookie is set with a new token value if it was not already present.

C The CSRF cookie remains unchanged or is not set if it was missing.

D The CSRF cookie is set to an empty string.

💡 Hint

Django sets the CSRF cookie on safe methods if missing.

Django sets the CSRF cookie with a new token on safe HTTP methods like GET if the cookie is missing, to prepare for future POST requests.

Practice

1. What is the main purpose of Django's CSRF protection mechanism?

easy

A. To prevent unauthorized websites from making unwanted requests on behalf of a user

B. To speed up the loading time of web pages

C. To encrypt user passwords in the database

D. To improve the visual design of forms

Solution

1. Step 1: Understand CSRF meaning

   CSRF stands for Cross-Site Request Forgery, which is an attack where unauthorized sites trick users into submitting unwanted requests.

2. Step 2: Identify Django's CSRF role

   Django's CSRF protection stops these attacks by verifying a secret token in forms, ensuring requests come from trusted sources.

3. Final Answer:

   To prevent unauthorized websites from making unwanted requests on behalf of a user -> Option A

4. Quick Check:

   CSRF protection = prevent unwanted cross-site requests [OK]

Hint: CSRF stops other sites from faking your form submissions [OK]

Common Mistakes:

• Confusing CSRF with password encryption
• Thinking CSRF speeds up page loading
• Believing CSRF improves form design

2. Which of the following is the correct way to include CSRF protection in a Django HTML form?

easy

A.

B. {% csrf_token %}

C. {% csrf %}

D. <csrf_token>

Solution

1. Step 1: Recall Django template syntax for CSRF

   Django uses the template tag {% csrf_token %} inside forms to insert the CSRF token as a hidden input automatically.

2. Step 2: Check each option's correctness

   <form method='post'>{% csrf_token %}</form> uses the correct Django template tag. Options B and C use incorrect tags. <form method='post'><input type='hidden' name='csrfmiddlewaretoken'></form> misses the token value and tag.

3. Final Answer:

   <form method='post'>{% csrf_token %}</form> -> Option B

4. Quick Check:

   Use {% csrf_token %} inside POST forms [OK]

Hint: Use {% csrf_token %} exactly inside POST forms [OK]

Common Mistakes:

• Using incorrect template tags like {% csrf %}
• Forgetting to add the token inside the form
• Trying to add CSRF token manually without the tag

3. Given this Django view and template snippet, what happens if the CSRF token is missing in the POST request?

def submit_view(request):
    if request.method == 'POST':
        return HttpResponse('Success')
    return render(request, 'form.html')



  
  Send

medium

A. The form will automatically add the CSRF token

B. The POST request will succeed and return 'Success'

C. The server will crash with an exception

D. The POST request will be rejected with a 403 Forbidden error

Solution

1. Step 1: Understand CSRF token role in POST

   Django requires a valid CSRF token in POST requests to prevent forgery attacks.

2. Step 2: Analyze missing token effect

   Since the form omits {% csrf_token %}, the POST request lacks the token, so Django rejects it with a 403 Forbidden error.

3. Final Answer:

   The POST request will be rejected with a 403 Forbidden error -> Option D

4. Quick Check:

   Missing CSRF token = 403 error [OK]

Hint: Missing CSRF token in POST causes 403 error [OK]

Common Mistakes:

• Assuming POST succeeds without token
• Thinking server crashes instead of 403
• Believing token is added automatically

4. You have a Django form that raises a CSRF verification failed error. Which of the following is the most likely cause?

medium

A. The {% csrf_token %} tag is missing inside the form

B. The form uses GET method instead of POST

C. The form action URL is incorrect

D. The form has no submit button

Solution

1. Step 1: Identify cause of CSRF verification failure

   CSRF verification fails when the token is missing or invalid in POST requests.

2. Step 2: Check each option's relevance

   Missing the {% csrf_token %} tag inside the form causes the token to be absent from the request. Options A, C, and D do not directly cause CSRF errors.

3. Final Answer:

   The {% csrf_token %} tag is missing inside the form -> Option A

4. Quick Check:

   Missing {% csrf_token %} causes CSRF failure [OK]

Hint: Always include {% csrf_token %} in POST forms [OK]

Common Mistakes:

• Thinking GET method causes CSRF errors
• Blaming wrong form action for CSRF failure
• Assuming submit button absence triggers CSRF error

5. You want to protect an AJAX POST request in Django from CSRF attacks. Which approach correctly includes the CSRF token in the request headers?

hard

A. Disable CSRF middleware for AJAX requests

B. Include {% csrf_token %} inside the AJAX data payload as a form field

C. Add the CSRF token value from the cookie to the 'X-CSRFToken' header in the AJAX request

D. Send the CSRF token as a URL query parameter

Solution

1. Step 1: Understand CSRF protection for AJAX

   Django expects the CSRF token in the 'X-CSRFToken' header for AJAX POST requests, usually read from the CSRF cookie.

2. Step 2: Evaluate options for AJAX token inclusion

   Add the CSRF token value from the cookie to the 'X-CSRFToken' header in the AJAX request correctly adds the token from the cookie to the header. Include {% csrf_token %} inside the AJAX data payload as a form field is incorrect because {% csrf_token %} is a template tag, not usable in JS. Disable CSRF middleware for AJAX requests disables protection (unsafe). Send the CSRF token as a URL query parameter is insecure and not recommended.

3. Final Answer:

   Add the CSRF token value from the cookie to the 'X-CSRFToken' header in the AJAX request -> Option C

4. Quick Check:

   AJAX CSRF token goes in 'X-CSRFToken' header [OK]

Hint: Send CSRF token in 'X-CSRFToken' header for AJAX POST [OK]

Common Mistakes:

• Trying to use {% csrf_token %} in JavaScript
• Disabling CSRF middleware instead of fixing token
• Sending token in URL query parameters