No CSRF token after Django 1.8 form error - django

Question

I recently upgraded my website to Django 1.8 and am getting an "ImportError No module named lib" when my signup (user registration) form is posted. Specifically, if a user is signing up for an account and their passwords don't match, my form will display an error. If they then enter matching passwords, I get the following Django error:
Request Method: POST
Request URL: http://localhost:8000/create_account/
Django Version: 1.8.4
Python Version: 2.7.5
Installed Applications:
['django.contrib.auth',
'django.contrib.contenttypes',
'django.contrib.sessions',
'django.contrib.sites',
'django.contrib.messages',
'django.contrib.staticfiles',
'django.contrib.admin',
'account',
'home',
'members',
'profile']
Installed Middleware:
('django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.common.CommonMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.auth.middleware.SessionAuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
'django.middleware.clickjacking.XFrameOptionsMiddleware',
'django.middleware.security.SecurityMiddleware')
Traceback:
File "/Users/me/venv/scores/lib/python2.7/site-packages/django/core/handlers/base.py" in get_response
125. response = middleware_method(request, callback, callback_args, callback_kwargs)
File "/Users/me/venv/scores/lib/python2.7/site-packages/django/middleware/csrf.py" in process_view
189. return self._reject(request, REASON_BAD_TOKEN)
File "/Users/me/venv/scores/lib/python2.7/site-packages/django/middleware/csrf.py" in _reject
101. return _get_failure_view()(request, reason=reason)
File "/Users/me/venv/scores/lib/python2.7/site-packages/django/middleware/csrf.py" in _get_failure_view
33. return get_callable(settings.CSRF_FAILURE_VIEW)
File "/Users/me/venv/scores/lib/python2.7/site-packages/django/utils/lru_cache.py" in wrapper
101. result = user_function(*args, **kwds)
File "/Users/me/venv/scores/lib/python2.7/site-packages/django/core/urlresolvers.py" in get_callable
112. if submod and not module_has_submodule(import_module(parentmod), submod):
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/importlib/__init__.py" in import_module
37. __import__(name)
Exception Type: ImportError at /create_account/
Exception Value: No module named lib
As you can see from the stacktrace, when the form is posted with matching passwords, the response is being deemed invalid by the middleware before control is even returned to the create_account view that displayed the form. I set a breakpoint in the urlresolvers.py module and found that the module that can't be found is "lib.local_csrf". I should add that the form itself is composed of both a signin (authentication) form and the signup (registration) form in question and both forms contain csrf_token tags:
# home/templates/home.html
<form action="{% url 'sign-in' %}" method="post">
{% csrf_token %}
<!-- error fields appear here -->
{% for field in sign_in_form.visible_fields %}
{{ field.label_tag }}
{{ field }}
<input type="submit" value="Sign in">
Forgot password?
</form>
<form action="{% url 'create-account' %}" method="post">
{% csrf_token %}
<!-- error fields appear here -->
{% for field in create_account_form.visible_fields %}
{{ field.label_tag }}
{{ field }}
{% endfor %}
{% for hidden in form.hidden_fields %}
{{ hidden }}
{% endfor %}
<input type="submit" value="Sign up">
</form>
Here is the create_account view:
# account/views.py
def create_account(request, template):
# Initialize the signin form on the same page.
sign_in_form = SignInAuthenticationForm(request, label_suffix="")
if request.method == "POST":
create_account_form = CreateAccountForm(request.POST, label_suffix="")
if create_account_form.is_valid():
user = User.objects.create_user(
username = create_account_form.cleaned_data['username'],
password = create_account_form.cleaned_data['password1']
)
# Create a new account.
account = Account(user=user)
account.save()
# Do other stuff and then redirect user to next form
else:
create_account_form = CreateAccountForm(label_suffix="")
return render_to_response(template, locals())
What's most interesting is that when I set a breakpoint in the process_view in django.middleware.csrf, the csrf_token and request_csrf_token variables both contain the same value when the user initially submits the form with mismatched passwords. But when they enter matching passwords and resubmit the form a second time, the csrf_token contains the token value but request_csrf_token is blank. This was confirmed by the fact that request.POST['csrfmiddlewaretoken'] is not in the request.POST dictionary when the user resubmits the form. I don't understand why this is happening.
This form worked perfectly well in Django 1.6 but it's stopped working in 1.8 (or possibly 1.7). I looked through the 1.7 and 1.8 release notes and didn't see any changes to the CSRF functionality. I also read the template docs that pertain to CSRF and didn't see anything new there. Doing an online search on this error didn't turn up anything either.
I suspect that some of you will suggest that I use the django-registration-redux library. I don't think I can use it due to my registration workflow. You see, after the user registers on this form, they're redirected first to a page when they enter their user profile, then to a page where they can upload a photo, and then to a page to review and approve their profile and photo. After that, they're forwarded to my payment processor. They're only truly registered with a valid account if my payment processor tells me their payment method has been approved.
Thanks.

Answer 1

The actual error No module named lib appears to be because Django can't import the CSRF_FAILURE_VIEW you have specified in your settings. You could try removing it from your settings, then Django should show the default CSRF failure page instead of the error. I can't tell why the import is failing, because you haven't shown what CSRF_FAILURE_VIEW or your project structure is.
To fix the CSRF error, try using the render shortcut instead of render_to_response. It renders the template with a request context, so that the csrf_token tag works.
# avoid locals() if possible!
return render(request, template, {...})