3 ms·
That's what I mean. If you forget to include the token on your app, it will fail. You have to remember to call {% csrf_token %} in every template. Back in the
by silviogutierrez 6y ago
That's what I mean. If you forget to include the token on your app, it will fail. You have to remember to call {% csrf_token %} in every template.
Back in the day, the middleware scanned your response and injected it next to each </form> tag. A hack and dirty for sure, but removed that burden.
- StavrosK 6y agoIt will fail securely, which is what you want. The alternative is to have it fail insecurely and bypass validation for everything. In the latest versions the framework sets the SameSite header properly, so you don't need the CSRF middleware at all (you can just remove it).