Why is Django admin login giving me 403 CSRF error?

Question

I am running Django 1.2.2 and I get the following error when I try to log in to the Django admin:

Forbidden (403) CSRF verification failed. Request aborted.

Reason given for failure:

No CSRF or session cookie.

** I have made NO customization to the barebones admin and when I inspect the source there is a CSRF token in the form in what I believe is the correct place.

When I look at the actual request that is being sent there is a csrf token being sent but Django still says CSRF verification failed.

Can anyone point me in the right direction? Why is this happening?

Answer 1

1) Do you have 'django.middleware.csrf.CsrfViewMiddleware' in your settings.MIDDLEWARE_CLASSES ?

2) Are you sure you've always been on 1.2.2? That only came out last night...

Answer 2

According to the docs, not only do you need the csrf hidden form field, but also the csrftoken cookie. The error message you provided also suggests a missing cookie.

I would look in your browser's cookies to ensure the csrftoken cookie is present.