A CSRF token is what a server includes in its response, that is the same token which is passed in the request from the user.

In my case, a different CSRF token is getting included in the request- which is hence generating a 403 Forbidden error.

Along the different CSRF token cookie, a new session ID cookie is also getting included, which should not be the case. I am guessing a new session is somehow getting created and hence including a different CSRF token but I am really not sure how and why is this happening. Seems a sort of re-login is happening.

What is more interesting is that this is happening only for a specific user. Any ideas what might be the case?

closed as off-topic by AndrolGenhald, ThoriumBR, Teun Vink, Rory Alsop Oct 1 '18 at 11:09

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – AndrolGenhald, ThoriumBR, Teun Vink, Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Sounds like the user is accessing the site with multiple tabs open. – John Wu Sep 19 '18 at 21:49
  • Do you have any other information regarding traffic which is coming from that user? Standard W3C logs should hopefully have that information. – user52472 Sep 19 '18 at 21:49
  • @user52472, do you mean server logs? In my django.logs- I have the same - "CSRF token missing or incorrect" error. – user2715898 Sep 19 '18 at 22:11
  • @JohnWu, seems to be happening in a single tab. – user2715898 Sep 19 '18 at 22:12

The most likely scenario with the information you've given us is that the user has opened a session in one window. They they open a new browser window, where there initial session times out and they are given a new session identifier. Now, they go back to their original browser window, and try and submit that form. This is where your expired information is coming from.

  • Hi @user52472, this is not the scenerio unfortunately. I tested it on my machine with the user's credentials and got the same error. The thing you described seems to be happening in the same session and I am not sure how – user2715898 Sep 19 '18 at 22:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.