Django: Login from page outside django

Question

Maybe it's a stupid question, but I'm trying to login to my django app using a form that is outside django. My guess is that I could send a POST request to /login, but that would fail because of the csrf token.

Maybe I'm missing some kind of theoretical background, but I would like to know what's the correct way to achieve this.

Background info: The django authentication is working fine IF you use the django login forms. What I'd like to do is to use an external static html form (on an apache outside django), to post to django directly so when I redirect to my django server, I don't have to login.

Answer 1

CSRF exists to prevent exactly this. Although you no doubt have good intentions, there's no technical difference between this and a hacker trying to steal access to your site via a real CSRF attack.

Answer 2

Sounds like you need a single-signon service like CAS: http://code.google.com/p/django-cas/

(but it's possible overkill)