Question: I am making an app of login form but when I am running my app and click on login button the following error will occur 

**Forbidden (403)
CSRF verification failed. Request aborted.**

the code of view.py is as:

```
from django.template import  loader
from django.shortcuts import render_to_response
from registration.models import Registration
from django.http import HttpResponse
from django.template import RequestContext
from django.shortcuts import redirect

def view_login(request,registration_id):
   t = loader.get_template('registration/login.html') 
   try:
         registration=Registration.objects.get(pk=registration_id)
   except Registration.DoesNotExist:
         return render_to_response("login.html",{"registration_id":registration_id})

def home(request,registration_id):
    if request.method == "POST":
      username = request.POST.get('user_name')
      password = request.POST.get('password')
      user = authenticate(username=username, password=password)
      if user is not None:
        if user.is_active:
          login(request, user)
        # success
          return render('registration/main_page.html',{'registration_id':registration_id},context_instance=RequestContext(user))
        else:
         #user was not active
           return redirect('q/',context_instance=RequestContext(user))
      else:
        # not a valid user
           return redirect('q/',context_instance=RequestContext(user))
    else:
       # URL was accessed directly
           return redirect('q/',context_instance=RequestContext(user))

```

Answer: 
You need to add `{% csrf_token %}` in your form

<https://docs.djangoproject.com/en/2.2/ref/csrf/>

like that :

```
<form>
    {% csrf_token %}
    <anything_else>
</form>

```

Also, you have to use RequestContext(request) everytime you use `render_to_response` :

```
return render_to_response("login.html",
    {"registration_id":registration_id},
    context_instance=RequestContext(request))

```

And you have to import authenticate and login :

```
from django.contrib.auth import authenticate, login

```
In **Django ≥ 4** it is now necessary to specify **CSRF\_TRUSTED\_ORIGINS** in **settings.py**

```
CSRF_TRUSTED_ORIGINS = ['https://your-domain.com', 'https://www.your-domain.com']

```

See [documentation](https://docs.djangoproject.com/en/4.0/releases/4.0/#csrf-trusted-origins-changes-4-0)