CSRF protection mechanism in Django - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a Django view lacks CSRF token validation?

Consider a Django view that processes POST requests but does not include CSRF token validation. What is the expected behavior when a POST request is made without a valid CSRF token?

Django

from django.views.decorators.csrf import csrf_exempt
from django.http import HttpResponse

@csrf_exempt
def my_view(request):
    if request.method == 'POST':
        return HttpResponse('POST received')
    return HttpResponse('Hello')

A The POST request is processed normally without any CSRF error.

B Django raises a 403 Forbidden error due to missing CSRF token.

C The server crashes with a server error (500).

D The POST request is redirected to the login page.

💡 Hint

Think about what the @csrf_exempt decorator does.

The @csrf_exempt decorator disables CSRF protection for the decorated view. Therefore, POST requests without a CSRF token are accepted and processed normally.

📝 Syntax

intermediate

Which template code correctly includes the CSRF token in a Django form?

You want to protect a form in a Django template from CSRF attacks. Which of the following template snippets correctly includes the CSRF token?

Django

<form method="post">
  <!-- CSRF token goes here -->
  <input type="text" name="username">
  <button type="submit">Submit</button>
</form>

A {% csrf_token %}{{ csrf_token }}

B {{ csrf_token }}

C {% csrf_token %}

D <input type="hidden" name="csrfmiddlewaretoken" value="{{ csrf_token }}">

💡 Hint

Django uses a special template tag to insert the CSRF token.

The correct way to include the CSRF token in a Django template form is using the {% csrf_token %} template tag. It inserts a hidden input with the token automatically.

🔧 Debug

advanced

Why does this Django view raise a CSRF verification failed error?

Examine the following Django view and template. The POST request raises a CSRF verification failed error. What is the cause?

Django

views.py:
from django.shortcuts import render
from django.views.decorators.csrf import csrf_protect

@csrf_protect
def submit_view(request):
    if request.method == 'POST':
        return render(request, 'success.html')
    return render(request, 'form.html')

form.html:
<form method="post">
  <input type="text" name="data">
  <button type="submit">Send</button>
</form>

A The CSRF middleware is disabled in settings.py.

B The view should use @csrf_exempt instead of @csrf_protect.

C The form method should be GET instead of POST.

D The template is missing the {% csrf_token %} tag inside the form.

💡 Hint

Check the form template for CSRF token inclusion.

The CSRF protection requires the token to be included in the form. The template lacks {% csrf_token %}, so Django rejects the POST request.

🧠 Conceptual

advanced

How does Django's CSRF protection mechanism verify POST requests?

Which of the following best describes how Django verifies that a POST request is safe from CSRF attacks?

A It compares the CSRF token in the POST data with a token stored in a cookie sent to the client.

B It verifies that the request comes from the same IP address as the server.

C It requires the user to enter a CAPTCHA on every POST request.

D It checks that the CSRF token in the POST data matches the token stored in the user's session cookie.

💡 Hint

Think about where Django stores the CSRF token on the client side.

Django stores a CSRF token in a cookie and expects the same token to be sent in the POST data. It compares these tokens to verify the request.

❓ state_output

expert

What is the value of the CSRF cookie after a GET request to a Django view with CSRF protection enabled?

A user visits a Django view protected by CSRF middleware with a GET request. What will be the state of the CSRF cookie in the browser after this request?

Django

from django.shortcuts import render

def my_view(request):
    return render(request, 'page.html')

A The CSRF cookie is deleted by the server.

B The CSRF cookie is set with a new token value if it was not already present.

C The CSRF cookie remains unchanged or is not set if it was missing.

D The CSRF cookie is set to an empty string.

💡 Hint

Django sets the CSRF cookie on safe methods if missing.

Django sets the CSRF cookie with a new token on safe HTTP methods like GET if the cookie is missing, to prepare for future POST requests.