Take the 2-minute tour ×

when I'm using following Python code to send a POST request to my Django website I'm getting 403: Forbidden error.

url = 'http://www.sub.domain.com/'
values = { 'var': 'test' }

    data = urllib.urlencode(values, doseq=True)
    req = urllib2.Request(url, data)
    response = urllib2.urlopen(req)
    the_page = response.read()
    the_page = sys.exc_info()

When I'm opening any other website it works properly. domain.com is Django website too, and it works properly too. I think, that's Django config problem, can anyone tell me what should I do to provide access to my script?

share|improve this question
Have you bothered checking the logs yet? –  Ignacio Vazquez-Abrams Jul 23 '11 at 14:16
Can you get to the webpage from a normal web browser? –  Ken Cochrane Jul 23 '11 at 14:29
I can get from normal browser. My server logs are empty, I do not have sufficient piriveges to view all of them on my hosting. –  Djent Jul 23 '11 at 14:39
add comment

2 Answers

up vote 8 down vote accepted

Does the view that you are posting to have a Django Form on it? If so, I wonder if it's giving a csrf error. I think that manifests itself as a 403. In that case, you'd need to add the {{ csrf_token }} tag. Just a thought.

share|improve this answer
Where have I to add that tag? If in template - it doesn't work. Here's my view: dpaste.com/575405, t.html is simply {{ form }} –  Djent Jul 23 '11 at 15:13
can you update the original question to inclue your code(view, urls, form) and html instead of linking off to dpaste? –  Ken Cochrane Jul 23 '11 at 15:37
@Djent why is t.html only a {{form}} is it included into other pages? if you just put {{form}} it isn't a valid webpage, and not even a valid form since {{form}} just puts the form elements you still need to add the form tags around it. –  Ken Cochrane Jul 23 '11 at 15:39
If it is a csrf problem you can try to disable csrf temporarliy on the view and see if that works, and if so then you know what the issue is. see this documentation for more help. docs.djangoproject.com/en/1.3/ref/contrib/csrf/#exceptions –  Ken Cochrane Jul 23 '11 at 15:43
add comment

Look here https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#how-to-use-it.

Try marking your view with @csrf_exempt. That way, Django's CSRF middleware will ignore CSRF protection. You'll also need to use from django.views.decorators.csrf import csrf_exempt. See: https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#utilities

Please be advised that by disabling CSRF protection on your view, you are opening a gate for CSRF attacks.

If security is vital to you then consider using @csrf_exempt followed by @requires_csrf_token (see: https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#unprotected-view-needs-the-csrf-token). Then, in your script pass this token and that's it.

share|improve this answer
add comment

Your Answer


