403 Forbidden CSRF cookie not set even when it is in the form

Question

When I attempt to log in to my django website, I always get a 403 Forbidden CSRF cookie not set error. When viewed via developer tools, the CSRF token was in the form response, but there were no cookies. I have django.middleware.csrf.CsrfViewMiddleware in my middleware, and I am using the standard django.contrib.auth.views.LoginView.
Here is my template:

{% extends 'base/formbase.html' %}

{% block title %}Login{% endblock title %}

{% block menuid %}menu-login{% endblock menuid %}

{% block submitname %}Login{% endblock submitname %}
{% block extra %}

     Forgot Your Password? 


    Don't have an account?  Sign Up! 

{% endblock extra %}

base/formbase.html:

{% extends 'base/base.html' %}

{% load crispy_forms_tags %}

{% block body %}

    
        
            
                {% block form %}
                {% block title %}{% endblock title %}
                
                    {% csrf_token %}
                    {{ form|crispy }}
                    
                
                {% endblock form %}
            
            {% block extra %}{% endblock extra %}
        
    

{% endblock body %}

base/base.html:


{% load base_extra %}


    {% settings gamename "GAME_NAME" %}
    
    {{ gamename }} - {% block title %}{% endblock title %}
    {% block head %}{% endblock head %}


    
    

    {% settings debug "DEBUG" %}

    {% if debug %}
    

    

    

    


    {% else %}
    

    

    

    

    {% endif %}




    {{ gamename }}
    

    
        
            
                Home (current)
            
            
                Game List
            
            
                Leaderboard
            
            {% if request.user.is_staff %}
            
                Admin
            
            {% endif %}
        
        
        
            {% if request.user.is_authenticated %}
            
                
                    {{ request.user }}
                
                
                    Profile
                    
                    Log out
                
            
            
                ${{ request.user.gameinfo.money }}
            
            {% else %}
            
                Sign Up
            
            
                Log In
            
            {% endif %}
        
    


    
    {% block body %}
    {% endblock body %}

Adding the @csrf_protect decorator does not solve the problem.

RaoufM · Accepted Answer

This may occur if you have CSRF_COOKIE_SECURE = True explanation in the docs Or if you have CSRF_COOKIE_HTTPONLY = True explanation or if you wish to just disable the csrf token you can add the @csrf_exempt decorator to the view

403 Forbidden CSRF cookie not set even when it is in the form

Answers (1)

Related Questions