from django import forms
from django.core.exceptions import PermissionDenied
from django.contrib.csrf.middleware import _make_token, _ERROR_MSG
class HiddenInputWithoutID(forms.HiddenInput):
def render(self, name, value, attrs=None):
if attrs and 'id' in attrs:
del attrs['id']
return super(HiddenInputWithoutID, self).render(name, value, attrs=attrs)
class SignedForm(forms.Form):
csrf_token = forms.CharField(max_length=32, widget=HiddenInputWithoutID)
def __init__(self, *args, **kwargs):
request = kwargs.pop('request', None)
if request:
csrf_token = _make_token(request.session.session_key)
kwargs.setdefault('initial', {})['csrf_token'] = csrf_token
return super(SignedForm, self).__init__(*args, **kwargs)
def clean_csrf_token(self):
csrf_token = self.initial.get('csrf_token')
value = self.cleaned_data.get('csrf_token')
if csrf_token != value:
raise PermissionDenied(_ERROR_MSG)
return value
Comments
I'm curious, what is the advantage of using this over the Django contrib CSRF Middleware[1]?
[1] http://docs.djangoproject.com/en/dev/ref/contrib/csrf/
#
@Tarken: Greater control. See the Limitations section on that page. Also, I consider the approach of parsing and rewriting the entire response inherently ugly. :)
#