I ran into this problem when running the Locust test against Django 1.8.5 and requested adding the csrf token to the cookies, headers and forms of the POST data, as well as below, so as not to catch 403. Something like:
@task def post_answer(self): response = self.client.get("/polls/2/vote") csrftoken = response.cookies['csrftoken'] self.client.post("/polls/2/vote/", {"choice": "8", "csrfmiddlewaretoken": csrftoken}, headers={"X-CSRFToken": csrftoken}, cookies={"csrftoken": csrftoken})
source share