Django - Login - Forbidden (CSRF token missing or incorrect.):

Question

I am getting the Forbidden (CSRF token missing or incorrect.) error when I try to use login page.

The scenario is as follows:

An user has two tabs open.
Both tabs are login pages.
In tab 1, user successfully logged in, and was redirected to a new page where login is required.
In tab 2, user hasn't refreshed the page, and is still in the login page. In the Django backend, user is already authenticated, but the front-end template hasn't noticed it yet.
In tab 2, when I click on login button, I get Forbidden (CSRF token missing or incorrect.) error.
I made sure that csrf_token is in the form.
This error occurs only when I'm using two tabs.
I'm using AJAX

Why is this happening? How can I fix it?

I don't know this would help, but here is my views.py for login

class Login_View(LoginView):

    template_name = 'login.html'

    def post(self, request, *args, **kwargs):
        username = request.POST['username']
        password = request.POST['password']
        user = authenticate(username=username, password=password)

        response_data = {}
        if user is not None:
            if user.is_active:
                login(request, user)
                response_data['result'] = 'success'
            else:
                return HttpResponse("Inactive user.")
        else:
            response_data['result'] = 'fail'

        return HttpResponse(json.dumps(response_data), content_type="application/json")

Possible duplicate of [django admin login suddenly demanding csrf token](https://stackoverflow.com/questions/29573163/django-admin-login-suddenly-demanding-csrf-token) — ubadub, Sep 17 '18 at 15:17

score 3 · Accepted Answer · answered Sep 17 '18 at 05:59

The reason is addressed in the documentation here:

For security reasons, CSRF tokens are rotated each time a user logs in. Any page with a form generated before a login will have an old, invalid CSRF token and need to be reloaded. This might happen if a user uses the back button after a login or if they log in a different browser tab.

As for fixing it, there's neither a straightforward way nor a great reason to do so. If the user encounters an error in this unlikely scenario all they have to do is reload the page. So I wouldn't bother if I were you.

score 1 · Answer 2 · answered Sep 17 '18 at 06:19

if a scenario occurs like this where user opens 2 tabs and tries to login, which is not a real life scenario, still if you want you can do this, keeping in mind the user like to play like this

def post(self, request, *args, **kwargs):
        username = request.POST['username']
        password = request.POST['password']
        if request.user.is_authenticated():
            return redirect('to_some_page')
        else:
            user = authenticate(username=username, password=password)

            response_data = {}
            if user is not None:
                if user.is_active:
                    login(request, user)
                    response_data['result'] = 'success'
                else:
                    return HttpResponse("Inactive user.")
            else:
                response_data['result'] = 'fail'

Django - Login - Forbidden (CSRF token missing or incorrect.):

2 Answers2