About CSRF Tokens
CSRF tokens are based on a random secret value. When validating the CSRF token field value, not the full token, but only the secret is compared with the secret in the cookie value or the session. This allows developers to use tokens that change for different requests, e.g. within each Ajax call.
However, it is important to note, that each login invalidates previously valid CSRF tokens and their secrets. So if you do login by an API call, make sure to refresh the tokens in the main page.
Tips and Tricks Programming Security Django 5.2 Django 4.2 Django 3.2
Django/Python Consulting
If you have a specific Django challenge or integration you'd like to solve, I'd be happy to help. Book a free 30-minute call to discuss your project, see if we're a good fit, and explore the best approach for your needs. After the call, you'll receive a tailored cost estimate based on what we discuss.
Also by me
Django Messaging
For Django-based social platforms.
Django Paddle Subscriptions
For Django-based SaaS projects.
Django GDPR Cookie Consent
For Django websites that use cookies.
