django: after upgrade to 1.2 CSRF raises 403 though I don't have CSRF protection enabled

Question

I have just upgraded to Django 1.2 and I am trying to run my project. After I login I get

Forbidden (403)
CSRF verification failed. Request aborted.

which is strange because I haven't enabled CSRF protection previously. Do I have to configure something else to have my project work?

Answer 1

http://docs.djangoproject.com/en/dev/ref/contrib/csrf/#upgrading-notes

Answer 2

It seems, that CSRF protection is on for contrib.admin views, which I use for login. This is why I get 403.

Answer 3

Yep, that's because you use contrib.admin view for login with a custom template. You should add csrf_token to your login template.