title: 403 Forbidden CSRF cookie not set even when it is in the form
body: <p>When I attempt to log in to my django website, I always get a 403 Forbidden CSRF cookie not set error. When viewed via developer tools, the CSRF token was in the form response, but there were no cookies. I have <code>django.middleware.csrf.CsrfViewMiddleware</code> in my middleware, and I am using the standard <code>django.contrib.auth.views.LoginView</code>.<br />
  Here is my template:</p>
  <pre><code>{% extends 'base/formbase.html' %}
  
  {% block title %}Login{% endblock title %}
  
  {% block menuid %}menu-login{% endblock menuid %}
  
  {% block submitname %}Login{% endblock submitname %}
  {% block extra %}
  &lt;div class=&quot;alert alert-danger&quot;&gt;
      &lt;a href=&quot;{% url 'password_reset' %}&quot;&gt; Forgot Your Password? &lt;/a&gt;
  &lt;/div&gt;
  &lt;div class=&quot;alert alert-secondary&quot;&gt;
      Don't have an account? &lt;a href=&quot;{% url 'signup' %}&quot;&gt; Sign Up! &lt;/a&gt;
  &lt;/div&gt;
  {% endblock extra %}
  </code></pre>
  <p>base/formbase.html:</p>
  <pre><code>{% extends 'base/base.html' %}
  
  {% load crispy_forms_tags %}
  
  {% block body %}
  &lt;div class=&quot;row justify-content-center&quot;&gt;
      &lt;div class=&quot;col-6&quot;&gt;
          &lt;div class=&quot;card&quot;&gt;
              &lt;div class=&quot;card-body&quot;&gt;
                  {% block form %}
                  &lt;h2&gt;{% block title %}{% endblock title %}&lt;/h2&gt;
                  &lt;form method=&quot;post&quot; novalidate&gt;
                      {% csrf_token %}
                      {{ form|crispy }}
                      &lt;button type=&quot;submit&quot; class=&quot;btn btn-primary&quot;&gt;{% block submitname %}{% endblock submitname %}
                      &lt;/button&gt;
                  &lt;/form&gt;
                  {% endblock form %}
              &lt;/div&gt;
              {% block extra %}{% endblock extra %}
          &lt;/div&gt;
      &lt;/div&gt;
  &lt;/div&gt;
  {% endblock body %}
  </code></pre>
  <p>base/base.html:</p>
  <pre><code>&lt;!DOCTYPE html&gt;
  {% load base_extra %}
  &lt;html lang=&quot;en&quot;&gt;
  &lt;head&gt;
      {% settings gamename &quot;GAME_NAME&quot; %}
      &lt;meta charset=&quot;UTF-8&quot;&gt;
      &lt;title&gt;{{ gamename }} - {% block title %}{% endblock title %}&lt;/title&gt;
      {% block head %}{% endblock head %}
  
  
      &lt;meta charset=&quot;utf-8&quot;&gt;
      &lt;meta name=&quot;viewport&quot; content=&quot;width=device-width, initial-scale=1, shrink-to-fit=no&quot;&gt;
  
      {% settings debug &quot;DEBUG&quot; %}
  
      {% if debug %}
      &lt;link rel=&quot;stylesheet&quot; href=&quot;https://stackpath.bootstrapcdn.com/bootstrap/latest/css/bootstrap.css&quot;&gt;
  
      &lt;script src=&quot;https://code.jquery.com/jquery-latest.js&quot;&gt;&lt;/script&gt;
  
      &lt;script src=&quot;https://unpkg.com/@popperjs/core/dist/umd/popper.js&quot;&gt;&lt;/script&gt;
  
      &lt;script src=&quot;https://stackpath.bootstrapcdn.com/bootstrap/latest/js/bootstrap.js&quot;&gt;&lt;/script&gt;
  
  
      {% else %}
      &lt;link rel=&quot;stylesheet&quot; href=&quot;https://stackpath.bootstrapcdn.com/bootstrap/latest/css/bootstrap.min.css&quot;&gt;
  
      &lt;script src=&quot;https://code.jquery.com/jquery-latest.min.js&quot;&gt;&lt;/script&gt;
  
      &lt;script src=&quot;https://unpkg.com/@popperjs/core/dist/umd/popper.min.js&quot;&gt;&lt;/script&gt;
  
      &lt;script src=&quot;https://stackpath.bootstrapcdn.com/bootstrap/latest/js/bootstrap.min.js&quot;&gt;&lt;/script&gt;
  
      {% endif %}
  
  &lt;/head&gt;
  &lt;body&gt;
  &lt;nav class=&quot;navbar navbar-expand-lg navbar-dark bg-primary&quot;&gt;
      &lt;a class=&quot;navbar-brand&quot; href=&quot;{% url 'index' %}&quot;&gt;{{ gamename }}&lt;/a&gt;
      &lt;button class=&quot;navbar-toggler&quot; type=&quot;button&quot; data-toggle=&quot;collapse&quot; data-target=&quot;#navbarSupportedContent&quot;
              aria-controls=&quot;navbarSupportedContent&quot; aria-expanded=&quot;false&quot; aria-label=&quot;Toggle navigation&quot;&gt;
          &lt;span class=&quot;navbar-toggler-icon&quot;&gt;&lt;/span&gt;
      &lt;/button&gt;
  
      &lt;div class=&quot;collapse navbar-collapse&quot; id=&quot;navbarSupportedContent&quot;&gt;
          &lt;ul class=&quot;navbar-nav mr-auto&quot;&gt;
              &lt;li class=&quot;nav-item&quot; id=&quot;menu-home&quot;&gt;
                  &lt;a class=&quot;nav-link&quot; href=&quot;{% url 'index' %}&quot;&gt;Home &lt;span class=&quot;sr-only&quot;&gt;(current)&lt;/span&gt;&lt;/a&gt;
              &lt;/li&gt;
              &lt;li class=&quot;nav-item&quot; id=&quot;menu-gamelist&quot;&gt;
                  &lt;a class=&quot;nav-link&quot; href=&quot;{% url 'game:game_list' %}&quot;&gt;Game List&lt;/a&gt;
              &lt;/li&gt;
              &lt;li class=&quot;nav-item&quot; id=&quot;menu-leaderboard&quot;&gt;
                  &lt;a class=&quot;nav-link&quot; href=&quot;{% url 'user_list' %}&quot;&gt;Leaderboard&lt;/a&gt;
              &lt;/li&gt;
              {% if request.user.is_staff %}
              &lt;li class=&quot;nav-item&quot; id=&quot;menu-admin&quot;&gt;
                  &lt;a class=&quot;nav-link&quot; href=&quot;{% url 'admin:index' %}&quot;&gt;Admin&lt;/a&gt;
              &lt;/li&gt;
              {% endif %}
          &lt;/ul&gt;
          &lt;!--
        &lt;form class=&quot;form-inline my-2 my-lg-0&quot;&gt;
          &lt;input class=&quot;form-control mr-sm-2&quot; type=&quot;search&quot; placeholder=&quot;Search&quot; aria-label=&quot;Search&quot;&gt;
          &lt;button class=&quot;btn btn-outline-success my-2 my-sm-0&quot; type=&quot;submit&quot;&gt;Search&lt;/button&gt;
        &lt;/form&gt;
      --&gt;
          &lt;ul class=&quot;navbar-nav ml-auto&quot;&gt;
              {% if request.user.is_authenticated %}
              &lt;li class=&quot;nav-item dropdown&quot;&gt;
                  &lt;a class=&quot;nav-link dropdown-toggle&quot; href=&quot;#&quot; id=&quot;navbarDropdown&quot; role=&quot;button&quot; data-toggle=&quot;dropdown&quot;
                     aria-haspopup=&quot;true&quot; aria-expanded=&quot;false&quot;&gt;
                      {{ request.user }}
                  &lt;/a&gt;
                  &lt;div class=&quot;dropdown-menu dropdown-menu-right&quot; aria-labelledby=&quot;navbarDropdown&quot;&gt;
                      &lt;a class=&quot;dropdown-item&quot; href=&quot;{% url 'user' user.pk %}&quot;&gt;Profile&lt;/a&gt;
                      &lt;div class=&quot;dropdown-divider&quot;&gt;&lt;/div&gt;
                      &lt;a class=&quot;dropdown-item&quot; href=&quot;{% url 'logout' %}&quot;&gt;Log out&lt;/a&gt;
                  &lt;/div&gt;
              &lt;/li&gt;
              &lt;li class=&quot;nav-item&quot;&gt;
                  &lt;div class=&quot;nav-link&quot;&gt;${{ request.user.gameinfo.money }}&lt;/div&gt;
              &lt;/li&gt;
              {% else %}
              &lt;li class=&quot;nav-item&quot; id=&quot;menu-signup&quot;&gt;
                  &lt;a class=&quot;nav-link&quot; href=&quot;{% url 'signup' %}&quot;&gt;Sign Up&lt;/a&gt;
              &lt;/li&gt;
              &lt;li class=&quot;nav-item&quot; id=&quot;menu-login&quot;&gt;
                  &lt;a class=&quot;nav-link&quot; href=&quot;{% url 'login' %}&quot;&gt;Log In&lt;/a&gt;
              &lt;/li&gt;
              {% endif %}
          &lt;/ul&gt;
      &lt;/div&gt;
  &lt;/nav&gt;
  &lt;div class=&quot;mx-3 mt-2&quot;&gt;
      &lt;script&gt;
  try {
    document.getElementById(&quot;{% block menuid %} {% endblock menuid %}&quot;).classList.add(&quot;active&quot;);
  }
  catch {}
      &lt;/script&gt;
      {% block body %}
      {% endblock body %}
  &lt;/div&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  <p>Adding the <code>@csrf_protect</code> decorator does not solve the problem.</p>