CSRF protection mechanism in Django - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does CSRF stand for and why is it a security risk?

CSRF stands for Cross-Site Request Forgery. It is a security risk because it tricks a user’s browser into making unwanted actions on a website where they are authenticated, without their consent.

beginner

How does Django protect against CSRF attacks by default?

Django uses a CSRF token, a unique secret value, that must be included in POST forms and AJAX requests. The server checks this token to confirm the request is from the trusted user.

beginner

Where should you include the CSRF token in a Django HTML form?

Inside the form tag, you include {% csrf_token %} template tag. This adds a hidden input with the CSRF token value that the server will verify on form submission.

intermediate

What happens if a POST request in Django does not include a valid CSRF token?

Django will reject the request and return a 403 Forbidden error. This prevents unauthorized or forged requests from being processed.

intermediate

How can you exempt a Django view from CSRF protection if needed?

You can use the @csrf_exempt decorator on the view function to disable CSRF checks for that view. Use this carefully as it removes protection.

What is the main purpose of the CSRF token in Django?

A To encrypt user passwords

B To verify the request comes from the authenticated user

C To speed up page loading

D To store user session data

The CSRF token ensures that the request is made intentionally by the authenticated user, protecting against forged requests.

Where do you add the CSRF token in a Django template form?

A Inside the form tag using {% csrf_token %}

B In the URL query string

C In the page header

D In the CSS file

The {% csrf_token %} tag adds a hidden input with the token inside the form, which Django checks on submission.

What HTTP status code does Django return if CSRF validation fails?

A 403 Forbidden

B 404 Not Found

C 500 Internal Server Error

D 200 OK

Django returns 403 Forbidden to block requests that fail CSRF validation.

Which Django decorator disables CSRF protection for a view?

A @require_POST

B @login_required

C @cache_page

D @csrf_exempt

The @csrf_exempt decorator disables CSRF checks for the decorated view.

CSRF attacks exploit which of the following?

A Weak password policies

B Server-side database vulnerabilities

C User’s authenticated session in the browser

D Slow internet connections

CSRF attacks use the user’s authenticated session to perform unwanted actions without their knowledge.

Explain how Django’s CSRF protection works in a typical form submission.

Think about what happens from form rendering to form submission.

Describe a situation where you might need to disable CSRF protection in Django and how to do it safely.

Consider when CSRF tokens are not practical but security is still important.

Practice

1. What is the main purpose of Django's CSRF protection mechanism?

easy

A. To prevent unauthorized websites from making unwanted requests on behalf of a user

B. To speed up the loading time of web pages

C. To encrypt user passwords in the database

D. To improve the visual design of forms

Solution

1. Step 1: Understand CSRF meaning

   CSRF stands for Cross-Site Request Forgery, which is an attack where unauthorized sites trick users into submitting unwanted requests.

2. Step 2: Identify Django's CSRF role

   Django's CSRF protection stops these attacks by verifying a secret token in forms, ensuring requests come from trusted sources.

3. Final Answer:

   To prevent unauthorized websites from making unwanted requests on behalf of a user -> Option A

4. Quick Check:

   CSRF protection = prevent unwanted cross-site requests [OK]

Hint: CSRF stops other sites from faking your form submissions [OK]

Common Mistakes:

• Confusing CSRF with password encryption
• Thinking CSRF speeds up page loading
• Believing CSRF improves form design

2. Which of the following is the correct way to include CSRF protection in a Django HTML form?

easy

A.

B. {% csrf_token %}

C. {% csrf %}

D. <csrf_token>

Solution

1. Step 1: Recall Django template syntax for CSRF

   Django uses the template tag {% csrf_token %} inside forms to insert the CSRF token as a hidden input automatically.

2. Step 2: Check each option's correctness

   <form method='post'>{% csrf_token %}</form> uses the correct Django template tag. Options B and C use incorrect tags. <form method='post'><input type='hidden' name='csrfmiddlewaretoken'></form> misses the token value and tag.

3. Final Answer:

   <form method='post'>{% csrf_token %}</form> -> Option B

4. Quick Check:

   Use {% csrf_token %} inside POST forms [OK]

Hint: Use {% csrf_token %} exactly inside POST forms [OK]

Common Mistakes:

• Using incorrect template tags like {% csrf %}
• Forgetting to add the token inside the form
• Trying to add CSRF token manually without the tag

3. Given this Django view and template snippet, what happens if the CSRF token is missing in the POST request?

def submit_view(request):
    if request.method == 'POST':
        return HttpResponse('Success')
    return render(request, 'form.html')



  
  Send

medium

A. The form will automatically add the CSRF token

B. The POST request will succeed and return 'Success'

C. The server will crash with an exception

D. The POST request will be rejected with a 403 Forbidden error

Solution

1. Step 1: Understand CSRF token role in POST

   Django requires a valid CSRF token in POST requests to prevent forgery attacks.

2. Step 2: Analyze missing token effect

   Since the form omits {% csrf_token %}, the POST request lacks the token, so Django rejects it with a 403 Forbidden error.

3. Final Answer:

   The POST request will be rejected with a 403 Forbidden error -> Option D

4. Quick Check:

   Missing CSRF token = 403 error [OK]

Hint: Missing CSRF token in POST causes 403 error [OK]

Common Mistakes:

• Assuming POST succeeds without token
• Thinking server crashes instead of 403
• Believing token is added automatically

4. You have a Django form that raises a CSRF verification failed error. Which of the following is the most likely cause?

medium

A. The {% csrf_token %} tag is missing inside the form

B. The form uses GET method instead of POST

C. The form action URL is incorrect

D. The form has no submit button

Solution

1. Step 1: Identify cause of CSRF verification failure

   CSRF verification fails when the token is missing or invalid in POST requests.

2. Step 2: Check each option's relevance

   Missing the {% csrf_token %} tag inside the form causes the token to be absent from the request. Options A, C, and D do not directly cause CSRF errors.

3. Final Answer:

   The {% csrf_token %} tag is missing inside the form -> Option A

4. Quick Check:

   Missing {% csrf_token %} causes CSRF failure [OK]

Hint: Always include {% csrf_token %} in POST forms [OK]

Common Mistakes:

• Thinking GET method causes CSRF errors
• Blaming wrong form action for CSRF failure
• Assuming submit button absence triggers CSRF error

5. You want to protect an AJAX POST request in Django from CSRF attacks. Which approach correctly includes the CSRF token in the request headers?

hard

A. Disable CSRF middleware for AJAX requests

B. Include {% csrf_token %} inside the AJAX data payload as a form field

C. Add the CSRF token value from the cookie to the 'X-CSRFToken' header in the AJAX request

D. Send the CSRF token as a URL query parameter

Solution

1. Step 1: Understand CSRF protection for AJAX

   Django expects the CSRF token in the 'X-CSRFToken' header for AJAX POST requests, usually read from the CSRF cookie.

2. Step 2: Evaluate options for AJAX token inclusion

   Add the CSRF token value from the cookie to the 'X-CSRFToken' header in the AJAX request correctly adds the token from the cookie to the header. Include {% csrf_token %} inside the AJAX data payload as a form field is incorrect because {% csrf_token %} is a template tag, not usable in JS. Disable CSRF middleware for AJAX requests disables protection (unsafe). Send the CSRF token as a URL query parameter is insecure and not recommended.

3. Final Answer:

   Add the CSRF token value from the cookie to the 'X-CSRFToken' header in the AJAX request -> Option C

4. Quick Check:

   AJAX CSRF token goes in 'X-CSRFToken' header [OK]

Hint: Send CSRF token in 'X-CSRFToken' header for AJAX POST [OK]

Common Mistakes:

• Trying to use {% csrf_token %} in JavaScript
• Disabling CSRF middleware instead of fixing token
• Sending token in URL query parameters