CSRF problem (403 FORBIDDEN)

[Gkpetrak]

Hello,

I'm developing an app using django and Openlayers javascript code. When I'm trying to post something via openlayers javascript code, it raises a 403 FORBIDDEN ERROR.
I don't use a form in my html file, the post applied by openlayers code. It runs successfully, only if I remove the 'django.middleware.csrf.CsrfViewMiddleware' from my settings.py.
How can I fix it ?
And how unprotected I am, without the 'django.middleware.csrf.CsrfViewMiddleware' in my settings.py ?

Thank you in advance,
George

[Sergiy Khohlov]

I'm proposing to update your views and templates for supporting csrf....
Many thanks,

Serge


+380 636150445
skype: skhohlov

> --
> You received this message because you are subscribed to the Google Groups
> "Django users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to django-users...@googlegroups.com.
> To post to this group, send email to django...@googlegroups.com.
> Visit this group at http://groups.google.com/group/django-users.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/django-users/06b5902c-9281-4aa1-9736-dbf2e1c98e1b%40googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[Andreas Kuhne]

To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/CADTRxJM3v6%2BfdSrA_%3DoEzzA%2ByRjLJsUCU9bzx2jxE5HoK-hAPA%40mail.gmail.com.

For more options, visit https://groups.google.com/d/optout.

I agree with Sergiy, you should update your code to use CSRF tokens. It's not that hard to implement. When django creates a form, you will get a csrf-token as a hidden form parameter, just send that in the form you are updating.

What you risk running without CSRF tokens are man-in-the-middle attacks. Check http://en.wikipedia.org/wiki/Cross-site_request_forgery for more information.

Regards,

Andréas