Take the 2-minute tour ×

I am writing a mobile application for a django website. i understand that every form in django has a CSRF token key for protection. when use browser to navigate the site, the server render a key for the user.

What i am confused is for mobile application, we dont need view the presetation layer from the site. I just wanna do a HTTP post to send data. I know i can use csrf_exempt to disable the csrf for that form. or i can make another view to render the csrf token for me, but this way i need extra parsing and http request. so is there a nicer way to do it?

Thanks for your time

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

If your mobile app is rendering a template you can add {% csrf_token %} into the template that renders the form. If you're not using a form and instead just posting data you can create the token as above and then simply post it's value with the data. And if you're not using a template to create the mobile app's markup well then use csrf_exempt (if say you're just posting data to the server periodically).

Obviously there has to be a view to process the posted data, but even if you're using a generic view for that you could still wrap that view (in your urls.py for example) and gain the use of csrf_exempt

share|improve this answer
The Django docs show how to handle AJAX with CSRF. Basically, this puts the CSRF token in a cookie that JavaScript then copies into the HTTP request. –  Mike DeSimone Jul 14 '11 at 17:36
Yeah that's what I was more or less suggesting to do. I've used that approach many times with ajax apps and it works smoothly. –  John Jul 14 '11 at 17:38
add comment

Your Answer


