Handling CSRF tokens in Django - django

Question

I've written a small standalone python script that's calling my django-based backend and everything is working fine with login and calling views requiring auth and so on.
A bit of code
def dostuff():
session = login(username, password)
license = add_license(session)
def _helper(self, url, cookie=None):
http = httplib2.Http()
if cookie:
headers = { "Cookie" : cookie }
else:
headers = {}
response, content = http.request(host + url, "GET", headers=headers, body="")
return response, content
def login(self, username, password):
url = "/license/login?username=%s&password=%s" % (username, password)
response, content = self._helper(url)
sessioncookie = response["set-cookie"]
customer_id = re.search("id=(?P<id>\d+)", content)
if response["status"] == "200":
return sessioncookie, customer_id.group("id")
def add_license(self, session):
cookie = session[0]
customer_id = int(session[1])-1
url = "/license/add_license?customer_id=%s" % customer_id
response, content = self._helper(url, cookie)
content = content[1:-1]
if response["status"] == "200": #ok
data = json.loads(content)
return data["fields"]
If I cahnge "GET" to "POST" I encounter the Django CSRF-error page(CSRF verification failed) in return. How can I send POST data to Django?
My login view in Django, do I need to do anything special to add the csrf token? My plan is to rewrite this to send json once things are working.
def my_login(request):
done, username = get_input(request, "username")
if not done:
return username
done, password = get_input(request, "password")
if not done:
return password
user = authenticate(username=username, password=password)
if user is not None:
if user.is_active:
login(request, user)
return HttpResponse("Done, id=%s" % user.pk)
else:
return HttpResponse("User disabled")
else:
return HttpResponse("Invalid login")

Answer 1

I got it working and this is how I did it. Like suggested by toto_tico I worte a dummy view that I retrieve thought GET to get the CSRF token. At first it didn't send the csrf token over GET so I had to add the decorator ensure_csrf_cookie.
#ensure_csrf_cookie
def dummy(request):
return HttpResponse("done")
And then I handle login requests normally.
def my_login(request):
...handle login...
It turned out that just adding the cookie to the POST wasn't enough, I had to write a token to the POST data as well.
def _helper(self, url, method="POST"):
req = urllib2.Request(host + url)
self.cookieMgr.add_cookie_header(req)
try:
if method == "GET":
response = self.opener.open(req)
else:
for cookie in self.cookieMgr:
if cookie.name == "csrftoken":
csrf = cookie.value
values = { "csrfmiddlewaretoken" : csrf}
params = urllib.urlencode(values)
response = self.opener.open(req, params)
code = response.getcode()
info = response.info()
content = response.read()
return code, info, content
except urllib2.HTTPError as ex:
print str(ex)
sys.exit(1)
def get_csrf(self):
url = "/license/dummy"
self._helper(url, method="GET")
def login(self, username, password):
self.get_csrf()
url = "/license/login?username=%s&password=%s" % (username, password)
code, info, content = self._helper(url)
if code == 200:
#done!

Answer 2

You have to add the csrftoken cookie value when you make a request to Django. Alternatively you can add #csrf_exempt to your Django backend to accept those requests.

Answer 3

Start reading about CSFR and ajax. I usually do the following with the code provided:
Create a csfr.js file
Paste the code in the csfr.js file
Reference the code in the template that needs it|
If you are using templates and have something like base.html where you extend from, then you can just reference the script from there and you don't have to worry any more in there rest of your programming. As far as I know, this shouldn't represent any security issue.