Django CSRF issues with cookies disabled

Question

While testing the application that I wrote in Django, I found that every time I submit the form, I get an HTTP 403 Forbidden error. I know that the CSRF middleware checks the cookie with the CSRF token - but what should be my approach for a user who has cookies disabled?

Do I need to check if cookies are allowed in each of my submissions or is there a better approach?

Thanks in advance.

This question was about Django pre-1.2 - the solution is different if you have an older version installed.

Answer 1

Django 1.2 403, CSRF_FAILURE_VIEW.

Answer 2

, : , , 403:

from django.http import HttpResponseForbidden
from django.conf import settings

from django.template import RequestContext
from django.shortcuts import render_to_response

class PermissionErrorMiddleware(object):
    def process_response(self, request, response):
        if isinstance(response, HttpResponseForbidden):
            return render_to_response('403.html', context_instance=RequestContext(request)) 

        return response

, , cookie ( ), 403 . " " 404 , .

Answer 3

cookie, , CSRF. , - , , , - .

Answer 4

Have you tried passing csrf information as a hidden POST variable? In projects that I participated in, it is usually done with hidden input:

<input type="hidden" name="csrf" value="<?=$person->csrf?>" />

Sorry for the PHP code, I don’t remember how to do this in Django templates.