CSRF protection mechanism in Django - Mini Project: Build & Apply

CSRF Protection Mechanism in Django

📖 Scenario: You are building a simple Django web application that includes a form for users to submit their email addresses to subscribe to a newsletter. To keep your app safe from Cross-Site Request Forgery (CSRF) attacks, you need to implement Django's CSRF protection mechanism correctly.

🎯 Goal: Build a Django view and template that safely handle a form submission with CSRF protection enabled. You will create the data setup, configure CSRF token usage, implement the form handling logic, and complete the template with the necessary CSRF token tag.

📋 What You'll Learn

Create a Django view function named subscribe that handles GET and POST requests.

Create a simple HTML form in a template named subscribe.html with an email input and a submit button.

Add a CSRF token in the form to protect against CSRF attacks.

Use Django's @csrf_protect decorator or ensure middleware is active for CSRF protection.

💡 Why This Matters

🌍 Real World

CSRF protection is essential for any web application that accepts user input via forms. It prevents malicious websites from tricking users into submitting unwanted requests.

💼 Career

Understanding and implementing CSRF protection is a fundamental skill for web developers working with Django or any web framework to ensure application security.

1

Create the initial Django view function

Create a Django view function called subscribe in views.py that imports render and HttpResponse from django.shortcuts and django.http respectively. The function should accept a request parameter and return render(request, 'subscribe.html') for now.

Django

# Your code here

Hint

Start by defining a function named subscribe that takes request and returns the rendered template subscribe.html.

2

Add a CSRF token variable in the template context

Modify the subscribe view function to import csrf_protect from django.views.decorators.csrf and decorate the function with @csrf_protect. This enables CSRF protection for the view.

Django

from django.shortcuts import render
from django.http import HttpResponse
# Import csrf_protect and decorate the subscribe function
# Your code here

Hint

Use the @csrf_protect decorator above your view function to enable CSRF protection.

3

Add form handling logic with POST method

Inside the subscribe view, add an if statement to check if request.method == 'POST'. If true, retrieve the email from request.POST['email'] and return an HttpResponse with the text "Subscribed: {email}" using an f-string. Otherwise, render the subscribe.html template as before.

Django

from django.shortcuts import render
from django.http import HttpResponse
from django.views.decorators.csrf import csrf_protect

@csrf_protect
def subscribe(request):
    # Add POST request handling below
    # Your code here

Hint

Check if the request method is POST, then get the email from request.POST and respond with a confirmation message.

4

Complete the HTML form with CSRF token

Create a file named subscribe.html with a simple HTML form that uses the POST method and has an input field with name="email". Inside the <form> tag, add the Django template tag {% csrf_token %} to include the CSRF token. Add a submit button labeled Subscribe.

Django

    
    
    Subscribe

Hint

Inside your form, add {% csrf_token %} to include the CSRF token for protection.

Practice

1. What is the main purpose of Django's CSRF protection mechanism?

easy

A. To prevent unauthorized websites from making unwanted requests on behalf of a user

B. To speed up the loading time of web pages

C. To encrypt user passwords in the database

D. To improve the visual design of forms

Solution

1. Step 1: Understand CSRF meaning

   CSRF stands for Cross-Site Request Forgery, which is an attack where unauthorized sites trick users into submitting unwanted requests.

2. Step 2: Identify Django's CSRF role

   Django's CSRF protection stops these attacks by verifying a secret token in forms, ensuring requests come from trusted sources.

3. Final Answer:

   To prevent unauthorized websites from making unwanted requests on behalf of a user -> Option A

4. Quick Check:

   CSRF protection = prevent unwanted cross-site requests [OK]

Hint: CSRF stops other sites from faking your form submissions [OK]

Common Mistakes:

• Confusing CSRF with password encryption
• Thinking CSRF speeds up page loading
• Believing CSRF improves form design

2. Which of the following is the correct way to include CSRF protection in a Django HTML form?

easy

A.

B. {% csrf_token %}

C. {% csrf %}

D. <csrf_token>

Solution

1. Step 1: Recall Django template syntax for CSRF

   Django uses the template tag {% csrf_token %} inside forms to insert the CSRF token as a hidden input automatically.

2. Step 2: Check each option's correctness

   <form method='post'>{% csrf_token %}</form> uses the correct Django template tag. Options B and C use incorrect tags. <form method='post'><input type='hidden' name='csrfmiddlewaretoken'></form> misses the token value and tag.

3. Final Answer:

   <form method='post'>{% csrf_token %}</form> -> Option B

4. Quick Check:

   Use {% csrf_token %} inside POST forms [OK]

Hint: Use {% csrf_token %} exactly inside POST forms [OK]

Common Mistakes:

• Using incorrect template tags like {% csrf %}
• Forgetting to add the token inside the form
• Trying to add CSRF token manually without the tag

3. Given this Django view and template snippet, what happens if the CSRF token is missing in the POST request?

def submit_view(request):
    if request.method == 'POST':
        return HttpResponse('Success')
    return render(request, 'form.html')



  
  Send

medium

A. The form will automatically add the CSRF token

B. The POST request will succeed and return 'Success'

C. The server will crash with an exception

D. The POST request will be rejected with a 403 Forbidden error

Solution

1. Step 1: Understand CSRF token role in POST

   Django requires a valid CSRF token in POST requests to prevent forgery attacks.

2. Step 2: Analyze missing token effect

   Since the form omits {% csrf_token %}, the POST request lacks the token, so Django rejects it with a 403 Forbidden error.

3. Final Answer:

   The POST request will be rejected with a 403 Forbidden error -> Option D

4. Quick Check:

   Missing CSRF token = 403 error [OK]

Hint: Missing CSRF token in POST causes 403 error [OK]

Common Mistakes:

• Assuming POST succeeds without token
• Thinking server crashes instead of 403
• Believing token is added automatically

4. You have a Django form that raises a CSRF verification failed error. Which of the following is the most likely cause?

medium

A. The {% csrf_token %} tag is missing inside the form

B. The form uses GET method instead of POST

C. The form action URL is incorrect

D. The form has no submit button

Solution

1. Step 1: Identify cause of CSRF verification failure

   CSRF verification fails when the token is missing or invalid in POST requests.

2. Step 2: Check each option's relevance

   Missing the {% csrf_token %} tag inside the form causes the token to be absent from the request. Options A, C, and D do not directly cause CSRF errors.

3. Final Answer:

   The {% csrf_token %} tag is missing inside the form -> Option A

4. Quick Check:

   Missing {% csrf_token %} causes CSRF failure [OK]

Hint: Always include {% csrf_token %} in POST forms [OK]

Common Mistakes:

• Thinking GET method causes CSRF errors
• Blaming wrong form action for CSRF failure
• Assuming submit button absence triggers CSRF error

5. You want to protect an AJAX POST request in Django from CSRF attacks. Which approach correctly includes the CSRF token in the request headers?

hard

A. Disable CSRF middleware for AJAX requests

B. Include {% csrf_token %} inside the AJAX data payload as a form field

C. Add the CSRF token value from the cookie to the 'X-CSRFToken' header in the AJAX request

D. Send the CSRF token as a URL query parameter

Solution

1. Step 1: Understand CSRF protection for AJAX

   Django expects the CSRF token in the 'X-CSRFToken' header for AJAX POST requests, usually read from the CSRF cookie.

2. Step 2: Evaluate options for AJAX token inclusion

   Add the CSRF token value from the cookie to the 'X-CSRFToken' header in the AJAX request correctly adds the token from the cookie to the header. Include {% csrf_token %} inside the AJAX data payload as a form field is incorrect because {% csrf_token %} is a template tag, not usable in JS. Disable CSRF middleware for AJAX requests disables protection (unsafe). Send the CSRF token as a URL query parameter is insecure and not recommended.

3. Final Answer:

   Add the CSRF token value from the cookie to the 'X-CSRFToken' header in the AJAX request -> Option C

4. Quick Check:

   AJAX CSRF token goes in 'X-CSRFToken' header [OK]

Hint: Send CSRF token in 'X-CSRFToken' header for AJAX POST [OK]

Common Mistakes:

• Trying to use {% csrf_token %} in JavaScript
• Disabling CSRF middleware instead of fixing token
• Sending token in URL query parameters