如何解决Django自定义用户登录错误：CSRF验证失败。 请求中止

Question

I have a django custom user login form, When user login the below error shows please help

            Forbidden (403)
    CSRF verification failed. Request aborted.

    Help
    Reason given for failure:

        CSRF token missing or incorrect.

The below Error shows in terminal

    UserWarning: A {% csrf_token %} was used in a t
emplate, but the context did not provide the value.  This is usually caused by not using RequestContext.
  "A {% csrf_token %} was used in a template, but the context "
[08/May/2018 23:44:13] "GET /login/ HTTP/1.1" 200 7798

here is my view

  @csrf_protect def user_login(request): context = RequestContext(request) if request.POST: username = request.POST.get('username') password = request.POST.get('username') user = authenticate(username=username, password=password) if user is not None: if user.is_active: login(request, user) return render_to_response('app/index.html', context_instance=RequestContext(request)) else: return HttpResponse("You're account is disabled.") else: return render_to_response('app/login.html', context_instance=RequestContext(request)) else: return render_to_response('app/login.html', {}, context) 

here is my login html code

  <form class="form-horizontal" name="LoginForm" action="/login/" method="post"> {% csrf_token %} {% if next %} <input type="hidden" name="next" value="{{ next }}" /> {% endif %} 

How to do it? When user successfully login the User_Profile template show , buth the URL remain http://127.0.0.1:8000/login/ I want to change the url to http://127.0.0.1:8000/students_profile

here is URL

  url(r'^students_profile/', views.IndexView.as_view(), name='students_profile'), 

Here is login form

  <form class="form-horizontal" name="LoginForm" action="." method="post"> {% csrf_token %} {% if next %} <input type="hidden" name="next" value="{{ next }}" /> {% endif %} 

Answer 1

Hey Please check your views.py I haven't seen your code but i guess you may have rendered without RequestContext that's why above error is showing. So you better use

render(request, 'template_name', {params});

From docs render() is the same as a call to render_to_response() with a context_instance argument that forces the use of a RequestContext.

Answer 2

Your template is already protected by {% csrf_token %} no need to have the decorator in your view: Also, rather than using render_to_response, you can use render from django.shortcuts

I reduce your codes a little bit, it's better to use

from django.contrib import messages

def user_login(request):
    if request.POST:
        username = request.POST.get('username')
        password = request.POST.get('password')
        user = authenticate(username=username, password=password)
        if user:
            if user.is_active:
                login(request, user)
                return render(request,'app/index.html',{})
            # the else statement
            return HttpResponse("You're account is disabled.")
        # the else statement
        messages.add_message(request,messages.WARNING,'Credentials invalid')
    return render(request,'app/login.html', {})

in templates retrieve the message like this:

{% if messages %}
<ul class="messages">
   {% for message in messages %}
   <li{% if message.tags %} class="{{ message.tags }}"{% endif %}>{{ message }}</li>
   {% endfor %}
 </ul>
{% endif %}