Question

I am using jQuery to do an AJAX POST, but get a CSRF error. I assume this is because the CSRF cookie isn’t sent to the client to send back. Is there a way I can fix this in Django 1.0?

Answer 1

Yuji’s suggestion pointed me in the right direction.

I was doing the AJAX POST from a view which was a result of a GET so the Django middleware did not generate any csrf token.

I used the code found in the csrf middleware (/usr/lib/python2.5/site-packages/django/contrib/csrf/middleware.py) to generate a csrf token which I send with the GET context. Now the AJAX POST works fine since the token is present.

To create the csrf token:

def csrf_token_create(request):

    from django.contrib.csrf.middleware import _make_token    

    try:
        session_id = request.COOKIES[settings.SESSION_COOKIE_NAME]
    except KeyError:
        # No session, no check required
        return None

    csrf_token = _make_token(session_id)
    return csrf_token

In the view context:

csrf_token = csrf_token_create(request)
return render_to_response('view.html', {'csrfmiddlewaretoken': csrf_token})

Add a hidden input for csrfmiddlewaretoken in the html template.