Django 2 by Example

Cross-Site Request Forgery in AJAX requests

You have learned Cross-Site Request Forgery in Chapter 2, Enhancing Your Blog with Advanced Features. With the CSRF protection active, Django checks for a CSRF token in all POST requests. When you submit forms, you can use the {% csrf_token %} template tag to send the token along with the form. However, it is a bit inconvenient for AJAX requests to pass the CSRF token as a POST data in with every POST request. Therefore, Django allows you to set a custom X-CSRFToken header in your AJAX requests with the value of the CSRF token. This allows you to set up jQuery or any other JavaScript library to automatically set the X-CSRFToken header in every request.

In order to include the token in all requests, ...