Django CSRF verification failed. Request aborted.- CSRF cookie not set

Question

I know this question has been asked before. I have tried almost all the options given by people but I cannot seem to solve it. I am a complete newbie so please let me know where I am going wrong.

I am trying to write a simple raw form. I have not implemented any authentication or session mechanism until now (but from what I have read that does not matter to this problem. Correct me if I am wrong).

When I try to submit my form, I get this error:

Forbidden (403)
CSRF verification failed. Request aborted.

Reason given for failure:
    CSRF cookie not set.

This is my code:

My Views.py has this method:

def submit(request):
    global alphabet_array
    dishes = Dish.objects.all().order_by('name')
    if request.method == "POST":
        print request.POST['restaurant']
        print request.POST['rating']
        render_to_response('index.html', {}, context_instance=RequestContext(request))
    else:
        render_to_response('index.html', {}, context_instance=RequestContext(request))

Many have said that using RequestContext solves this issue but for me even that is not working.

The template looks as below:

  <form role="form" action="/submit/" method="post">{% csrf_token %}
                <div class="form-group">
                  <label for="">Restaurant Name</label>
                  <input type="text" name="restaurant" class="form-control" id="">
                </div>
                <div class="form-group">
                  <label for="">Rating</label>
                  <select class="form-control" name="rating">
                    <option>--</option>
                    <option>1 (very bad)</option>
                    <option>2 (bad)</option>
                    <option>3 (average)</option>
                    <option>4 (good)</option>
                    <option>5 (excellent)</option>
                  </select>
                </div>
               <button type="submit" class="btn btn-primary btn-block"><i class="fa fa-check-circle"></i> Save</button>
    </form>

The middleware_classes in settings.py looks like:

MIDDLEWARE_CLASSES = (
    'django.middleware.common.CommonMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
)

django.middleware.csrf.CsrfViewMiddleware is there and it is below 'django.contrib.sessions.middleware.SessionMiddleware'

My url.py is has entries:

url(r'^admin/', include(admin.site.urls)),
    url(r'^index/$', 'testapp.views.index'),

    url(r'^starts_with/(?P<alphabet>.+)/dish/(?P<dish_id>\d+)/$', 'testapp.views.alphabet_dish'),
    url(r'^starts_with/(?P<alphabet>.+)/$', 'testapp.views.alphabet'),
    url(r'^submit/$', 'testapp.views.submit'),

I am really not sure what is the problem here. As I said, I have read similar posts here and tried everything mentioned in the responses. What have I missed? My browser is Chrome and it is accepting cookies.

Answer 1

Your CSRF setup is fine. The problem is you are not returning the result. Remember that the view is a function. You need to return render_to_response(...) not just call it (which is also why by removing CSRF you got the didn't return an HttpResponse error)

Other than that, you are doing a few general things that are django-ically wrong:

• Don't use render_to_response (use render).
• Don't repeat yourself.
• Don't use globals in django.

Hence:

def submit(request):
    # global alphabet_array
    dishes = Dish.objects.all().order_by('name')
    if request.method == "POST":
        print request.POST['restaurant']
        print request.POST['rating']

    return render(request, 'index.html', {})