The Django blog has a description of the CSRF problem here: http://www.djangoproject.com/weblog/2011/feb/08/security/ http://www.djangoproject.com/weblog/2011/

The Django blog has a description of the CSRF problem here: http://www.djangoproject.com/weblog/2011/feb/08/security/ http://www.djangoproject.com/weblog/2011/feb/08/security/ Briefly, when both frameworks got an "X-Requested-With" header, they assumed that it was coming from a browser XmlHttpRequest, and that the same-origin policy was in effect. So, they skipped CSRF checks. However, it turns out that there is a way (details still not disclosed, other than that plugins and redirects are involved) for an attacker to force arbitrary headers onto a web request. Ooops. Both frameworks are now applying CSRF checks strictly, with no exceptions for apparent XHR.