Protección CSRF y flujo POST

CSRF tricks a logged-in user into submitting a hidden request. Django blocks it so attackers cannot act on a user's behalf. 🔒

Django enables CsrfViewMiddleware by default, so every unprotected POST is rejected until you add the right token.

Add {% csrf_token %} inside every POST form. It injects a hidden field with a per-session secret token.

The token proves the request came from your own page. A forged form on another site cannot guess it, so the POST fails.

A GET request displays a blank, unbound form so the user can start typing their input.

A POST sends the filled values back. You bind them to the form and run validation before doing anything.

If the bound form is_valid(), process cleaned_data: save it, send an email, or whatever the form is for.

On success, redirect to a new URL. This Post/Redirect/Get pattern stops a refresh from resubmitting the data.

If validation fails, re-render the same template with the bound form. It still holds the input and shows each error.

This GET-to-show, POST-to-process shape is the standard form view. One view handles both methods cleanly.

JavaScript POSTs must send the token in the X-CSRFToken header, read from the csrftoken cookie, or Django rejects them.

Add csrf_token to every POST form. GET shows the form, POST validates it, then redirect on success or re-render on errors. ✅