Django Template Tags - CSRF Protection in Forms {% csrf_token %} Login

The `{% csrf_token %}` tag is optional for POST forms and only required for sensitive operations like password changes.

The CSRF token is automatically added by Django and does not need to be explicitly included in the template.

The `{% csrf_token %}` tag generates a visible token that users must enter manually for security purposes.

18 / 29Django Templates and Template TagsMediumPython - Django Framework

Django Template Tags - CSRF Protection in Forms

<form method="POST" action="/submit/">
    {% csrf_token %}
    <input type="text" name="username" required>
    <input type="password" name="password" required>
    <button type="submit">Login</button>
</form>

The `{% csrf_token %}` tag is optional for POST forms and only required for sensitive operations like password changes.
The `{% csrf_token %}` must be included in every form that uses POST method to prevent CSRF attacks.
The CSRF token is automatically added by Django and does not need to be explicitly included in the template.
The `{% csrf_token %}` tag generates a visible token that users must enter manually for security purposes.

Show answer & explanation

Correct answer

The `{% csrf_token %}` must be included in every form that uses POST method to prevent CSRF attacks.

Explanation

The `{% csrf_token %}` tag inserts a hidden CSRF (Cross-Site Request Forgery) token into forms. This token is validated by Django's middleware to ensure that POST requests originate from your application. Omitting this tag will cause POST requests to fail with a 403 Forbidden error.

Written by ExamHoot EditorialPublished 18 Aug 2026 · Updated 27 Aug 2026

Explanation

All 29 Django Templates and Template Tags questions