# Forbidden (CSRF token missing or incorrect.)

**URL:** https://forum.djangoproject.com/t/forbidden-csrf-token-missing-or-incorrect/8478
**Category:** Using Django
**Created:** [June 22, 2021, 11:14pm UTC](https://forum.djangoproject.com/t/forbidden-csrf-token-missing-or-incorrect/8478 "2021-06-22T23:14:00Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![gunaratna](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/gunaratna/32/1900_2.png) [@gunaratna](https://forum.djangoproject.com/u/gunaratna)
#### Post date: [June 22, 2021, 11:14pm UTC](https://forum.djangoproject.com/t/forbidden-csrf-token-missing-or-incorrect/8478/1 "2021-06-22T23:14:00Z")

</div>

Getting error: Forbidden (CSRF token missing or incorrect.)

HTML page:

```auto
<b>All Posts</br></b>
    </br>
    {% if user.is_authenticated %}
    <div class="newPost">
    <div>New Post</div>
    <!--. Add new post form begins -->

        <form action="{% url 'index' %}" method="post" name="AddPost" id="postform">
            {% csrf_token %}
            
            <div >
                <textarea class="txtarea" name="txtarea" id="txtarea" placeholder="Body"></textarea>
            </div>
            <div>
                <input type="submit" value = "Post" id="SubmitPost">
            </div>
        </form>
    <!--. Add new post form ends -->
    </div>
    <div>
        <b>{{user}}</b>
    </div class="Container" name="Container" id="Container">
    <div>
     </div>
    {% block script %}
    <script src="{% static 'network/jsindex.js' %}" defer>
        </script>
    {% endblock %}

    {% endif %}
{% endblock %}

```

JS file:

```auto
document.addEventListener('submit',function(event){
    event.preventDefault();
    x = document.querySelector('textarea').value
    fetch('/posts', {
        method: 'POST',

        body: JSON.stringify({
            pcontent: x,
               })
      })
      .then(response => response.json())
      .then(result => {
        // Print result
          console.log(result);
      });
})

```

---

<div class="post-metadata">

### Author: ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)
#### Post date: [June 22, 2021, 11:22pm UTC](https://forum.djangoproject.com/t/forbidden-csrf-token-missing-or-incorrect/8478/2 "2021-06-22T23:22:36Z")

</div>

You need to make sure that the csrf token is included in your AJAX POST. See the [AJAX docs](https://docs.djangoproject.com/en/3.2/ref/csrf/#ajax) for this.

---

<div class="post-metadata">

### Author: ![gunaratna](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/gunaratna/32/1900_2.png) [@gunaratna](https://forum.djangoproject.com/u/gunaratna)
#### Post date: [June 23, 2021, 12:24am UTC](https://forum.djangoproject.com/t/forbidden-csrf-token-missing-or-incorrect/8478/3 "2021-06-23T00:24:58Z")

</div>

Thanks for the reply. I am not sure where exactly settings need to be changed.

---

<div class="post-metadata">

### Author: ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)
#### Post date: [June 23, 2021, 12:46am UTC](https://forum.djangoproject.com/t/forbidden-csrf-token-missing-or-incorrect/8478/4 "2021-06-23T00:46:04Z")

</div>

It’s not a settings change, it’s a code change in the function doing the POST. You need to include the csrf\_token in the data you’re submitting.

---

<div class="post-metadata">

### Author: ![gunaratna](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/gunaratna/32/1900_2.png) [@gunaratna](https://forum.djangoproject.com/u/gunaratna)
#### Post date: [June 24, 2021, 1:35am UTC](https://forum.djangoproject.com/t/forbidden-csrf-token-missing-or-incorrect/8478/6 "2021-06-24T01:35:07Z")

</div>

Thanks for the reply. I will try it.

---

<div class="post-metadata">

### Author: ![gunaratna](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/gunaratna/32/1900_2.png) [@gunaratna](https://forum.djangoproject.com/u/gunaratna)
#### Post date: [June 26, 2021, 6:11pm UTC](https://forum.djangoproject.com/t/forbidden-csrf-token-missing-or-incorrect/8478/7 "2021-06-26T18:11:41Z")

</div>

I changed the code and it works. Thank you very much!