SignedForm: CSRF-protect forms with a hidden token field
This form subclass helps protect against cross-site request forgery by adding a hidden field named `csrf_token` to forms. The form must be initialized with the request as a keyword argument, both with and without POST data: my_form = MySignedForm(request=request) ... my_form = MySignedForm(request.POST, request=request) Upon validation, a `PermissionDenied` exception will be raised if forgery is detected. If any security details have been overlooked in this recipe, please leave a comment.
- forms
- csrf