SignedForm: CSRF-protect forms with a hidden token field

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
from django import forms
from django.core.exceptions import PermissionDenied
from django.contrib.csrf.middleware import _make_token, _ERROR_MSG

class HiddenInputWithoutID(forms.HiddenInput):
    def render(self, name, value, attrs=None):
        if attrs and 'id' in attrs:
            del attrs['id']
        return super(HiddenInputWithoutID, self).render(name, value, attrs=attrs)

class SignedForm(forms.Form):
    csrf_token = forms.CharField(max_length=32, widget=HiddenInputWithoutID)

    def __init__(self, *args, **kwargs):
        request = kwargs.pop('request', None)
        if request:
            csrf_token = _make_token(request.session.session_key)
            kwargs.setdefault('initial', {})['csrf_token'] = csrf_token
        return super(SignedForm, self).__init__(*args, **kwargs)

    def clean_csrf_token(self):
        csrf_token = self.initial.get('csrf_token')
        value = self.cleaned_data.get('csrf_token')
        if csrf_token != value:
            raise PermissionDenied(_ERROR_MSG)
        return value

More like this

  1. Tamper safe HiddenFields by alexmeisel 5 years, 5 months ago
  2. Fieldsets for Views by Nad/ 4 years, 2 months ago
  3. CSRF this! by oggy 5 years, 6 months ago
  4. Hidden Forms by insin 6 years, 9 months ago
  5. Add CSRF token to templates by coleifer 2 years, 9 months ago

Comments

exogen (on October 17, 2009):

@Tarken: Greater control. See the Limitations section on that page. Also, I consider the approach of parsing and rewriting the entire response inherently ugly. :)

#

(Forgotten your password?)