# CSRF token missing (403)

**URL:** <https://forum.djangoproject.com/t/csrf-token-missing-403/33408>\
**Category:** Forms & APIs\
**Created:** [July 30, 2024, 11:06am UTC](https://forum.djangoproject.com/t/csrf-token-missing-403/33408 "2024-07-30T11:06:42Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Suhel-El-Salim](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/suhel-el-salim/32/22862_2.png) [@Suhel-El-Salim](https://forum.djangoproject.com/u/Suhel-El-Salim)\
**Post date:** [July 30, 2024, 11:06am UTC](https://forum.djangoproject.com/t/csrf-token-missing-403/33408/1 "2024-07-30T11:06:42Z")

</div>

Hello @all,

there are many questions regarding this topic and it feels like I have read all. But I still can’t solve this problem.

I can load my form and fill in the fields, but when I send the form I get the error that the csrf token is missing.

Template tag {% csrf\_token %} is in the form  
‘django.middleware.common.CommonMiddleware’, is used  
Cookies are accepted  
I can see the csrf token in the form when the site is loaded  
Tried different browsers (also privat browsing)  
Django version 5.0.7

template

```auto
{% block content %}

<div class="row mb-4">
    <div class="col">
        <h3>Registrierung</h3>
        
    </div>
</div>
<div class="row mb-4">
    <div class="col">
        <img src="{% static 'app1/logo.png' %}"><img src="{% static 'logo.png' %}"><a href="/admin">Zum Admin-Login</a>
    </div>
</div>
<div class="row mb-4">
    <div class="col">
        <form method="post" action="" enctype="text/plain">
            {% csrf_token %}
            {{ form.as_p }}
            <button type="submit" class="btn btn-success btn-sm">Speichern</button>
        </form>
    </div>
</div>
{% endblock content %}

```

forms.py

```auto
from django import forms
from .models import Person

class PersonForm(forms.ModelForm):
   
   class Meta:
      model = Person
      fields = ' __all__'

```

models.py

```auto
from django.db import models

class Person(models.Model):
    vorname = models.CharField(max_length=50)
    nachname = models.CharField(max_length=50)
    email = models.EmailField()
    phone = models.CharField(max_length=50)

    def __str__ (self):
        return self.vorname +' '+ self.nachname

```

views.py

```auto
from django.http import HttpResponseRedirect
from django.shortcuts import render, HttpResponse
from .forms import PersonForm
from django.shortcuts import render, redirect

# Create your views here.
def home(request):
    if request.method == 'POST':
        
        form = PersonForm(request.POST)
        if form.is_valid():
            form.save()
            return HttpResponseRedirect('/success')
    
    else:
        
        form = PersonForm()
        return render(request, 'app1/index.html', {'form': form})
        
    

def success(request):
    return HttpResponse('Hat geklappt')

```

urls.py

```auto
from django.urls import path
from . import views

urlpatterns = [
    path('', views.home, name='home'),
    path('success', views.success, name='success'),
]

```

What am I missing? What more can I do to check what’s wrong?

Thanks.

Suhel

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [July 30, 2024, 12:12pm UTC](https://forum.djangoproject.com/t/csrf-token-missing-403/33408/2 "2024-07-30T12:12:09Z")

</div>

Please post the full error message with the traceback (if any) that you are receiving on the server from these requests.

---

<div class="post-metadata">

**Author:** ![Suhel-El-Salim](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/suhel-el-salim/32/22862_2.png) [@Suhel-El-Salim](https://forum.djangoproject.com/u/Suhel-El-Salim)\
**Post date:** [July 30, 2024, 12:28pm UTC](https://forum.djangoproject.com/t/csrf-token-missing-403/33408/3 "2024-07-30T12:28:02Z")

</div>

![grafik](https://us1.discourse-cdn.com/flex026/uploads/djangoproject/original/3X/1/0/10c83c43f2512b0f196bba598c7d4d1f4340dd57.png)

Forbidden (CSRF token missing.): /  
[30/Jul/2024 14:24:48] “POST / HTTP/1.1” 403 2517

local development server 127.0.0.1:8000, Windows + VisualStudio Code

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [July 30, 2024, 12:29pm UTC](https://forum.djangoproject.com/t/csrf-token-missing-403/33408/4 "2024-07-30T12:29:07Z")

</div>

Please post the message and any traceback from the server console where you’re running runserver, _not_ the browser page being returned.

Also, you can use the network tab in your browser’s developer tools to look at the post request being issued. Please verify that you are seeing both the cookie and the csrf\_token being returned in the post.

Side note: I’d suggest removing the `enctype` attribute from your form. That’s not the default `enctype` for posted data, and it _might_ be causing an issue with Django being able to understand the submission.

---

<div class="post-metadata">

**Author:** ![Astral-Weeks](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/astral-weeks/32/22930_2.png) [@Astral-Weeks](https://forum.djangoproject.com/u/Astral-Weeks)\
**Post date:** [July 30, 2024, 2:52pm UTC](https://forum.djangoproject.com/t/csrf-token-missing-403/33408/5 "2024-07-30T14:52:15Z")

</div>

Does it change if you add something to the action field, rather than a blank action=“”?

---

<div class="post-metadata">

**Author:** ![Suhel-El-Salim](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/suhel-el-salim/32/22862_2.png) [@Suhel-El-Salim](https://forum.djangoproject.com/u/Suhel-El-Salim)\
**Post date:** [July 30, 2024, 3:08pm UTC](https://forum.djangoproject.com/t/csrf-token-missing-403/33408/6 "2024-07-30T15:08:48Z")

</div>

Hello Ken,

great! It was the enctype attribute from the form. When I submit a form with **enctype=“”** or with **enctype=“multipart/form-data”** it works.

Not with **enctype=“text/plain”**

Do you know the reason for this behavior, and is this correct?

Thank you very much!

Greetings  
Suhel

---

<div class="post-metadata">

**Author:** ![Suhel-El-Salim](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/suhel-el-salim/32/22862_2.png) [@Suhel-El-Salim](https://forum.djangoproject.com/u/Suhel-El-Salim)\
**Post date:** [July 30, 2024, 3:11pm UTC](https://forum.djangoproject.com/t/csrf-token-missing-403/33408/7 "2024-07-30T15:11:05Z")

</div>

Hello Astral-Weeks,

it makes no difference if I enter the URL or if I leave the action blank.

The reason for this problem was the enctype attribute. See my answer to Ken.

Best regards  
Suhel

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [July 30, 2024, 3:15pm UTC](https://forum.djangoproject.com/t/csrf-token-missing-403/33408/8 "2024-07-30T15:15:43Z")

</div>

This appears to be proper behavior.

See the docs at [HTMLFormElement: enctype property - Web APIs | MDN](https://developer.mozilla.org/en-US/docs/Web/API/HTMLFormElement/enctype) to see why.

---

<div class="post-metadata">

**Author:** ![Suhel-El-Salim](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/suhel-el-salim/32/22862_2.png) [@Suhel-El-Salim](https://forum.djangoproject.com/u/Suhel-El-Salim)\
**Post date:** [July 30, 2024, 3:24pm UTC](https://forum.djangoproject.com/t/csrf-token-missing-403/33408/9 "2024-07-30T15:24:28Z")

</div>

That’s it:

 ![grafik](https://us1.discourse-cdn.com/flex026/uploads/djangoproject/original/3X/6/a/6a3c9e8308680f7c90c24ab0564ddc3ac09c40ac.png)

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [July 30, 2024, 3:45pm UTC](https://forum.djangoproject.com/t/csrf-token-missing-403/33408/10 "2024-07-30T15:45:09Z")

</div>

Yep, you got it.

Side note: For future reference, please do not post images of **any** text data. Code, templates, snippets from docs, scripts, output, error messages, etc should all be copied from the source text, and pasted into the body of your post, between lines of three backtick - ` characters as appropriate. Thanks!