CSRF protection mechanism in Django - Step-by-Step Execution

Concept Flow - CSRF protection mechanism

User sends form request

↓

Server checks CSRF token

↓

Token valid?

No→Reject request

↓

Process request

↓

Send response back

The server checks if the CSRF token sent with the form matches the one stored in the user session. If valid, the request is processed; otherwise, it is rejected.

Execution Sample

Django

from django.views.decorators.csrf import csrf_protect
from django.http import HttpResponse

@csrf_protect
def submit_form(request):
    if request.method == 'POST':
        # process form
        return HttpResponse('Success')
    return HttpResponse('Method not allowed', status=405)

This Django view uses CSRF protection to verify POST requests have a valid CSRF token before processing.

Execution Table

Step	Action	CSRF Token in Request	Token Valid?	Result
1	User submits form with CSRF token	token123	Checked	Valid
2	Server compares token with session	token123	True	Request processed
3	Response sent to user	-	-	Success message returned
4	User submits form without token	None	Checked	Invalid
5	Server rejects request	None	False	403 Forbidden error

💡 Execution stops when token is invalid or request is processed successfully.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 4	Final
csrf_token_in_request	None	token123	token123	None	None
token_valid	False	Checked	True	Checked	False
request_processed	False	False	True	False	False

Key Moments - 2 Insights

Why does the server reject the request if the CSRF token is missing?

Because the server compares the token in the request with the session token and finds none, it marks the token as invalid and rejects the request (see execution_table step 4 and 5).

What happens if the CSRF token in the request matches the session token?

The server marks the token as valid and processes the request normally (see execution_table step 2).

Visual Quiz - 3 Questions

Look at the execution table, what is the token_valid value at step 2?

A Checked

B True

C False

D None

💡 Hint

Check the 'token_valid' column at step 2 in the execution_table.

At which step does the server reject the request due to missing CSRF token?

A Step 5

B Step 4

C Step 3

D Step 1

💡 Hint

Look for the step where 'Result' shows '403 Forbidden error' in the execution_table.

If the user sends a valid token, what is the final value of 'request_processed'?

A False

B Checked

C True

D None

💡 Hint

Refer to variable_tracker row for 'request_processed' after step 2.

Concept Snapshot

CSRF protection in Django:
- Server checks token in POST requests
- Token must match session token
- If valid, request processes normally
- If invalid or missing, server rejects with 403
- Use @csrf_protect decorator or middleware

Full Transcript

CSRF protection in Django works by checking a special token sent with POST requests. When a user submits a form, the server looks for this token and compares it to the one stored in the user's session. If the tokens match, the server processes the request and sends a success response. If the token is missing or does not match, the server rejects the request with a 403 Forbidden error. This mechanism helps prevent attackers from tricking users into submitting unwanted requests. In Django, you enable this protection by using the @csrf_protect decorator or the built-in middleware.