django csrf failed when posting from non-secure to secure page - django

Question

I am having login forms in all static pages. I have enabled csrf middleware in my project. Now when the user submits the form from http static page i get the error,
csrf verification failed
Is there a way to ensure cross site validation, even when posted from non-scure to secure page?
I want to neither add scrf exempt decorator nor change the page to https.
This is my template:
<form action='{{login_url}}' method = 'post'>
{% csrf_token %}
<div class="searchbox login">
<input autocomplete="off" id="id_fakeusername" type="text" name="fakeusername" maxlength="100" value='Email' style="color: #727272" onfocus="$('#id_fakeusername').hide();$('#id_username').show();
$('#id_username').focus();" />
<input autocomplete="off" type='text' id="id_username" type="text" name="username" maxlength="100" style="display: none" value='' onblur="if ($('#id_username').attr('value') == '') {$('#id_username').hide();$('#id_fakeusername').show();}" />
</div>
<div class="searchbox login">
<input autocomplete="off" id="id_fakepassword" type="text" name="fakepassword" maxlength="50" style="color: #727272" value='Password' onfocus="$('#id_fakepassword').hide(); $('#id_password').show(); $('#id_password').focus();" />
<input autocomplete="off" type='password' id="id_password" name="password" type="text" style="display: none" value='' onblur="if ($('#id_password').attr('value') == '') {$('#id_password').hide();$('#id_fakepassword').show();}" />
</div>
{% block nativewin %}
<div class="loginbut"><input type="submit" border="0" title="Login" value="Login" /></div>
{% endblock nativewin %}
</form>

Answer 1

From the CsrfViewMiddleware code [1]:
# Suppose user visits http://example.com/
# An active network attacker (man-in-the-middle, MITM) sends a
# POST form that targets https://example.com/detonate-bomb/ and
# submits it via JavaScript.
#
# The attacker will need to provide a CSRF cookie and token, but
# that's no problem for a MITM and the session-independent
# nonce we're using. So the MITM can circumvent the CSRF
# protection. This is true for any HTTP connection, but anyone
# using HTTPS expects better! For this reason, for
# https://example.com/ we need additional protection that treats
# http://example.com/ as completely untrusted. Under HTTPS,
# Barth et al. found that the Referer header is missing for
# same-domain requests in only about 0.2% of cases or less, so
# we can use strict Referer checking.
So I think the answer to your question is 'no', using the built-in protection!
[1] https://github.com/django/django/blob/master/django/middleware/csrf.py#L118

Answer 2

Did you included the {{ csrf_token }} in your template?
<form action="/contact/" method="post">{% csrf_token %}
{{ form.as_p }}
<input type="submit" value="Submit" />
</form>
Did you included a RequestContext in render_to_response?
from django.template import RequestContext
from django.shortcuts import render_to_response
return render_to_response('contact.html', {'form': form},
context_instance=RequestContext(request))
If it still not work, follow the steps as described in the docs.