How can I get a CSRF token from the command line?

django django-csrf
Naftuli Kay picture Naftuli Kay · Nov 7, 2013 · Viewed 7.8k times · Source

I'm frequently testing my application using curl and in the past I've had to simply wrap my views with csrf_exempt. I really don't want to do this, as I have a nasty feeling that I'll forget to do this in deployment and enjoy a lifetime of CSRF hell.

Is there a way for me to request a CSRF token using Django's shell commands? I'd like to get a token I could send with my curl requests to test things safely.

Answer

Paulo Scardine picture Paulo Scardine · Nov 7, 2013

Make an initial GET request to the form URL in order to fill the cookie jar:

$ curl http://example.com/some-form/ -o /dev/null -c cookies.txt -s

Get the value of the csrftoken cookie:

$ grep csrftoken cookies.txt | cut -f 7
YQkfXZCKtPP0hC30NmH10jSWuf6yJA5E

When issuing a POST, just include a csrfmiddlewaretoken field with this value (and use the same cookie jar).

I use the same trick to write end-to-end tests using the requests library.

Related questions

"CSRF token missing or incorrect" while post parameter via AJAX in Django

I try to post parameter like jQuery.ajax( { 'type': 'POST', 'url': url, 'contentType': 'application/json', 'data': "{content:'xxx'}", 'dataType': 'json', 'success': rateReviewResult } ); However, Django return Forbidden 403. CSRF verification failed. Request aborted. I am using 'django.middleware.csrf.CsrfViewMiddleware' and couldn't …

Read More
Django Rest Framework remove csrf

I know that there are answers regarding Django Rest Framework, but I couldn't find a solution to my problem. I have an application which has authentication and some functionality. I added a new app to it, which uses Django Rest …

Read More
How to use curl with Django, csrf tokens and POST requests

I'm using curl to test one of my Django forms. The calls I've tried (with errors from each, and over multiple lines for readability): (1): curl -d "{\"email\":\"[email protected]\"}" --header "X-CSRFToken: [triple checked value from the source code of …

Read More