Is the {% csrf_token %} CSRF protection tag still necessary in Django 1.2? -
i testing csrf protection on site , have noticed unexpected.
i removed {% csrf_token %}
form , submission still works. couldn't work out why. looked @ source , realised token still there right next <form>
element. changed id of form make sure updating source , hidden input still there.
i using django 1.2. {% csrf_token %}
still necessary?
cheers
rich
after more investigation appears {% csrf_token %}
inserted if form has method post
, not if doesn't. clever auto protection django.
Comments
Post a Comment