Question

If I send an AJAX POST request from a button. Do I need to validate the CSRF token in my view or does Django automatically do this for you when it accepts the POST? If not, how do I manually validate it myself?

Also, is it correct that when you create a Form and pass in the request, the Form object will automatically do this validation?

jQuery:

<script>
$(document).ready(function() {  
  $('#button1').click(function(){
    $.post("/", { 
      unique_id : "{{ unique_id }}",
      csrfmiddlewaretoken: '{{ csrf_token }}'
    });
  });
});
</script>

Answer 1

If you have 'django.middleware.csrf.CsrfViewMiddleware', in MIDDLEWARE_CLASSES in your project settings.py then CsrfViewMiddleware is automatically validate the csrf_token. This is mentioned in the documentation also:

For all incoming requests that are not using HTTP GET, HEAD, OPTIONS
or TRACE, a CSRF cookie must be present, and the ‘csrfmiddlewaretoken’
field must be present and correct. If it isn’t, the user will get a
403 error.

This check is done by CsrfViewMiddleware.