Using #csrf_exempt and creating a CSRF token in the same view - django

Question

I am expecting a POST from a 3rd party server. I understand that I need to use the #csrf_exempt decorator to allow for a post from a 3rd party server. I'm using Django 1.4 and Python 2.7 on Ubuntu 12.04.
Now, my view is going to generate an un-bound form that will contain fields for a user to populate as well as hidden fields containing information from the original POST. So, the first POST will initiate a second POST.
The second POST is going to be sent from my server to another view on my server. I'm trying to figure out how to generate a CSRF token for my form.
I'm trying to do exactly what I've read in the documentation.
My code from views.py:
from django.core.context_processors import csrf
from django.shortcuts import render_to_response
from gateway_interface.post_handling import PostHandling
#csrf_exempt
def requestNewPaymentInfo(request):
c = {}
c.update(csrf(request))
# Gather information posted
if (request.method == "POST"):
# Create the initialization dictionary based on POST values
postHandling = PostHandling()
post_dict = postHandling.createDictionary(request)
# Create the form
form = addPaymentForm(initial = post_dict)
return render_to_response('requestNewPaymentInfo.html', { 'form' : form }, c)
What do you do on the template side now?!? Again, from the documentation I thought I should do the following:
<form action="/addPayment/" method="post">
{% csrf_token %}
</form>
I test this by doing a POST from a 3rd party server. Sometimes I see the form fully generated with what appears to be a valid CSRF token.
Sometimes I see a failure that looks like this:
Django Version: 1.4
Python Version: 2.7.3
Installed Applications:
('django.contrib.auth',
'django.contrib.contenttypes',
'django.contrib.sessions',
'django.contrib.sites',
'django.contrib.messages',
'django.contrib.staticfiles',
'django.contrib.admin',
'gateway_interface')
Installed Middleware:
('django.middleware.common.CommonMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware')
Traceback:
File "/usr/local/lib/python2.7/dist-packages/django/core/handlers/base.py" in get_response
111. response = callback(request, *callback_args, **callback_kwargs)
File "/usr/local/lib/python2.7/dist-packages/django/views/decorators/csrf.py" in wrapped_view
77. return view_func(*args, **kwargs)
File "/home/tokeniz/tokeniz/gateway_interface/views.py" in requestNewPaymentInfo
64. return render_to_response('requestNewPaymentInfo.html', { 'form' : form }, c)
File "/usr/local/lib/python2.7/dist-packages/django/shortcuts/__init__.py" in render_to_response
20. return HttpResponse(loader.render_to_string(*args, **kwargs), **httpresponse_kwargs)
File "/usr/local/lib/python2.7/dist-packages/django/template/loader.py" in render_to_string
178. context_instance.pop()
Exception Type: TypeError at /requestNewPaymentInfo/
Exception Value: pop expected at least 1 arguments, got 0
Then I will eventually get this error:
Forbidden (403)
CSRF verification failed. Request aborted.
Once I receive the CSRF verification failed error I will continue to get this error until I clear the cookies and start over.
Can anyone tell me what I'm doing wrong? I can see it has something to do with how I generate the CSRF token. I don't understand how the process works based on what is in the documentation. What is c in my view? An empty dictionary that I'm populating with information and passing to render_to_response. Ok, but how is that being used in the template?
Should my template have something like this:
<form action="/addPayment/" method="post">
{% c.csrf_token %}
</form>
If not, why? How does Django know that this c contains the CSRF token?
Any help would be greatly appreciated.

Answer 1

To fix your problem, let me can clarify some things.
Django's template system in a nutshell works with two pieces of data: context and template.
When you put a variable to display in your template file, like {{ foo }}, django is going to look inside corresponding context instance, which a dict on steroids, to find the value of that variable.
Now to render_to_response, what you pass to it as a second parameter, a dict, is essentially the data you want to put in template's context, and so it will be available for you. The third paramater is a Context instance, not the data itself, it can be useful when you need to customize things.
Ok, so let's look at your example,
return render_to_response('requestNewPaymentInfo.html', { 'form' : form }, c)
Here, you made a mistake reading docs example, you put c as a context instance, not context data, hence your token didn't even make it to the template, and you got all those weird errors where django was expecting Context object, but only got dict.
So to fix, you just need to pass csrf token inside template data:
c.update({'form': form})
return render_to_response('requestNewPaymentInfo.html', c)
And inside the template:
{% csrf_token %}
I would suggest reading template system explanation for programmers, it is very well written.