---
source: https://iinventedlight.com/library/notes/django-csrf.md
title: "Django CSRF protection uses a cookie and a hidden form field"
license: CC-BY-4.0
license_url: https://creativecommons.org/licenses/by/4.0/
source_license: "BSD-3-Clause (django/django); prose restates cited source lines in own words"
license_family: django-bsd3
attribution: "Summary by iinventedlight (AI-assisted). Sources: Django docs, Cross Site Request Forgery protection, BSD-3-Clause (django/django); Django source, django.middleware.csrf.CsrfViewMiddleware, BSD-3-Clause (django/django). Notices: Django documentation and source (django/django): Copyright (c) Django Software Foundation and individual contributors; BSD-3-Clause (https://raw.githubusercontent.com/django/django/stable/6.1.x/LICENSE)."
author: "iinventedlight (synthesis of cited sources); text drafted with AI assistance"
date: 2026-11-10
status: published
approved_by: "Cole Withington, 2026-11-10 10:08 PT, Librarian chat widget t33s2: \"Yes, publish all 25 Django and Vue drafts\""
checked_on: 2026-11-10
as_of: 2026-11-10
confidence: medium
untested: "No Django project was run for this note; only the fetched documentation and source files were read."
category: coding-references
topic_area: "code-backend: Django csrf"
tags: [django, csrf, middleware, forms, cookies]
client: Librarian
sources:
  - id: S1
    title: "Cross Site Request Forgery protection"
    publisher: Django docs
    url: https://docs.djangoproject.com/en/6.1/ref/csrf/
    accessed: 2026-11-10
    license: "BSD-3-Clause"
  - id: S2
    title: "django.middleware.csrf.CsrfViewMiddleware"
    publisher: Django source
    url: https://github.com/django/django/blob/stable/6.1.x/django/middleware/csrf.py
    accessed: 2026-11-10
    license: "BSD-3-Clause"
---
# Django CSRF protection uses a cookie and a hidden form field

**Answer:** Django's CSRF middleware and template tag protect against cross-site request forgeries: a malicious site triggering an action on your site with the browser credentials of a logged-in user.

## Cookie and form field

Protection is based on a CSRF cookie whose value is a random secret other sites cannot access, plus a hidden form field named `csrfmiddlewaretoken` on outgoing POST forms. The field value is a masked form of the secret and changes per response. Incoming requests other than GET, HEAD, OPTIONS, or TRACE must present both a cookie and a correct field, or they get a 403.

## Middleware

`CsrfViewMiddleware` requires a present and correct `csrfmiddlewaretoken` for POST requests that have a CSRF cookie, and it sets an outgoing CSRF cookie. Use it together with the `{% csrf_token %}` template tag.

## See also

- [django-middleware](https://iinventedlight.com/library/notes/django-middleware/)
- [django-forms](https://iinventedlight.com/library/notes/django-forms/)

## Claims

- id: C1
  claim: Django's CSRF middleware and template tag protect against cross-site request forgeries.
  source: S1
  evidence: "The CSRF middleware and template tag provides easy-to-use protection against Cross Site Request Forgeries."

- id: C2
  claim: The CSRF cookie is a random secret value.
  source: S1
  evidence: "A CSRF cookie that is a random secret value,"

- id: C3
  claim: The csrf middleware implements protection against request forgeries from other sites.
  source: S2
  evidence: "This module provides a middleware that implements protection against request forgeries from other sites."

- id: C4
  claim: POST requests must present a correct csrfmiddlewaretoken when a CSRF cookie is set.
  source: S2
  evidence: "Require a present and correct csrfmiddlewaretoken for POST requests that have a CSRF cookie,"

## Sources

- [S1] Cross Site Request Forgery protection. Django docs. https://docs.djangoproject.com/en/6.1/ref/csrf/ . License: BSD-3-Clause. Accessed 2026-11-10.

- [S2] django.middleware.csrf.CsrfViewMiddleware. Django source. https://github.com/django/django/blob/stable/6.1.x/django/middleware/csrf.py . License: BSD-3-Clause. Accessed 2026-11-10.


License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted). Sources and notices: Django documentation and source (django/django): Copyright (c) Django Software Foundation and individual contributors; BSD-3-Clause (https://raw.githubusercontent.com/django/django/stable/6.1.x/LICENSE). Text was condensed and changed from the originals.

---

Agents: [/agents.md](/agents.md) | [/.well-known/agent-library.json](/.well-known/agent-library.json).