← All notes

Answer: Django's CSRF middleware and template tag protect against cross-site request forgeries: a malicious site triggering an action on your site with the browser credentials of a logged-in user.

Cookie and form field

Protection is based on a CSRF cookie whose value is a random secret other sites cannot access, plus a hidden form field named csrfmiddlewaretoken on outgoing POST forms. The field value is a masked form of the secret and changes per response. Incoming requests other than GET, HEAD, OPTIONS, or TRACE must present both a cookie and a correct field, or they get a 403.

Middleware

CsrfViewMiddleware requires a present and correct csrfmiddlewaretoken for POST requests that have a CSRF cookie, and it sets an outgoing CSRF cookie. Use it together with the {% csrf_token %} template tag.

See also

• django-middleware
• django-forms

Claims

• id: C1 claim: Django's CSRF middleware and template tag protect against cross-site request forgeries. source: S1 evidence: "The CSRF middleware and template tag provides easy-to-use protection against Cross Site Request Forgeries."

• id: C2 claim: The CSRF cookie is a random secret value. source: S1 evidence: "A CSRF cookie that is a random secret value,"

• id: C3 claim: The csrf middleware implements protection against request forgeries from other sites. source: S2 evidence: "This module provides a middleware that implements protection against request forgeries from other sites."

• id: C4 claim: POST requests must present a correct csrfmiddlewaretoken when a CSRF cookie is set. source: S2 evidence: "Require a present and correct csrfmiddlewaretoken for POST requests that have a CSRF cookie,"

Sources

• [S1] Cross Site Request Forgery protection. Django docs. https://docs.djangoproject.com/en/6.1/ref/csrf/ . License: BSD-3-Clause. Accessed 2026-11-10.

• [S2] django.middleware.csrf.CsrfViewMiddleware. Django source. https://github.com/django/django/blob/stable/6.1.x/django/middleware/csrf.py . License: BSD-3-Clause. Accessed 2026-11-10.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted). Sources and notices: Django documentation and source (django/django): Copyright (c) Django Software Foundation and individual contributors; BSD-3-Clause (https://raw.githubusercontent.com/django/django/stable/6.1.x/LICENSE). Text was condensed and changed from the originals.

@misc{iil_note_9b88d3sg,
  author = {{iinventedlight}},
  title = {{Django CSRF protection uses a cookie and a hidden form field}},
  howpublished = {iinventedlight Library},
  year = {2026},
  date = {2026-11-10},
  url = {https://iinventedlight.com/library/notes/django-csrf/},
  note = {Permanent ID iil:note:9b88d3sg. License: CC-BY-4.0.},
}

Markdown

Spotted a mistake? Use the MCP feedback tool or email hello@iinventedlight.com.

For language models and agents: start at /llms.txt | /agents.md | /.well-known/agent-library.json. This page in Markdown: /library/notes/django-csrf.md.