Fix Forbidden (403): CSRF verification failed. Request aborted. in Django

This error means Django's CSRF protection rejected a POST request because the CSRF token was missing or invalid. Fix it by including {% csrf_token %} in your form template, ensuring the CSRF middleware is active, and for AJAX requests, sending the token in the X-CSRFToken header extracted from the csrftoken cookie.

Reading the Stack Trace

Here's what each line means:

• File "/venv/lib/python3.11/site-packages/django/middleware/csrf.py", line 385, in process_view: Django's CSRF middleware intercepts every POST request and validates the CSRF token before the view runs.
• File "/venv/lib/python3.11/site-packages/django/middleware/csrf.py", line 322, in _check_token: The token check failed because no valid CSRF token was found in the request body or headers.
• raise PermissionDenied('CSRF verification failed. Request aborted.'): Django returns a 403 Forbidden response to prevent potential cross-site request forgery attacks.

Common Causes

<!-- templates/contact.html -->
<form method="post" action="/contact/">
  <input type="text" name="message" />
  <button type="submit">Send</button>
</form>

fetch('/api/submit/', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ message: 'hello' }),
});

# settings.py
ALLOWED_HOSTS = ['myapp.example.com']
# Missing: CSRF_TRUSTED_ORIGINS = ['https://myapp.example.com']

The Fix

Add {% csrf_token %} inside every form that uses method POST. For AJAX requests, extract the CSRF token from the csrftoken cookie and send it in the X-CSRFToken header. In production with Django 4+, also add your domain to CSRF_TRUSTED_ORIGINS.

<!-- templates/contact.html -->
<form method="post" action="/contact/">
  <input type="text" name="message" />
  <button type="submit">Send</button>
</form>

<!-- templates/contact.html -->
<form method="post" action="/contact/">
  {% csrf_token %}
  <input type="text" name="message" />
  <button type="submit">Send</button>
</form>

<!-- For AJAX requests, add this JavaScript -->
<script>
function getCookie(name) {
    let cookieValue = null;
    if (document.cookie && document.cookie !== '') {
        const cookies = document.cookie.split(';');
        for (let i = 0; i < cookies.length; i++) {
            const cookie = cookies[i].trim();
            if (cookie.substring(0, name.length + 1) === (name + '=')) {
                cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
                break;
            }
        }
    }
    return cookieValue;
}

fetch('/api/submit/', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json',
        'X-CSRFToken': getCookie('csrftoken'),
    },
    body: JSON.stringify({ message: 'hello' }),
});
</script>

Testing the Fix

import pytest
from django.test import TestCase, Client


class TestCSRFProtection(TestCase):
    def setUp(self):
        self.client = Client(enforce_csrf_checks=True)

    def test_post_without_csrf_token_returns_403(self):
        response = self.client.post('/contact/', {'message': 'hello'})
        assert response.status_code == 403

    def test_post_with_csrf_token_succeeds(self):
        # Use the regular client which includes CSRF token automatically
        client = Client()
        response = client.get('/contact/')
        assert response.status_code == 200
        response = client.post('/contact/', {'message': 'hello'})
        assert response.status_code in (200, 302)

    def test_form_template_contains_csrf_token(self):
        client = Client()
        response = client.get('/contact/')
        self.assertContains(response, 'csrfmiddlewaretoken')

Run your tests:

pytest

Pushing Through CI/CD

git checkout -b fix/csrf-token-missing,git add templates/contact.html settings.py,git commit -m "fix: add CSRF token to form and configure trusted origins",git push origin fix/csrf-token-missing

Your CI config should look something like this:

name: CI
on:
  pull_request:
    branches: [main]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          cache: 'pip'
      - run: pip install -r requirements.txt
      - run: python manage.py check --deploy
      - run: pytest --tb=short -q

The Full Manual Process: 18 Steps

Here's every step you just went through to fix this one bug:

1. Notice the error alert or see it in your monitoring tool
2. Open the error dashboard and read the stack trace
3. Identify the file and line number from the stack trace
4. Open your IDE and navigate to the file
5. Read the surrounding code to understand context
6. Reproduce the error locally
7. Identify the root cause
8. Write the fix
9. Run the test suite locally
10. Fix any failing tests
11. Write new tests covering the edge case
12. Run the full test suite again
13. Create a new git branch
14. Commit and push your changes
15. Open a pull request
16. Wait for code review
17. Merge and deploy to production
18. Monitor production to confirm the error is resolved

Total time: 30-60 minutes. For one bug.

pip install bugstack

import bugstack

bugstack.init(api_key=os.environ["BUGSTACK_API_KEY"])

Deploying the Fix (Manual Path)

1. Run the full test suite locally including CSRF enforcement tests.
2. Open a pull request with the template and settings changes.
3. Wait for CI checks to pass on the PR.
4. Have a teammate review and approve the PR.
5. Merge to main and verify CSRF-protected forms work correctly in staging.

Frequently Asked Questions