title: CSRF Cookie not set or CSRF verification failed for https upload on django website
body: <p><a href="/questions/tagged/django-csrf" class="post-tag" title="show questions tagged 'django-csrf'" rel="tag">django-csrf</a>
  <a href="/questions/tagged/django" class="post-tag" title="show questions tagged 'django'" rel="tag">django</a></p>
  
  <p>As many people around, I've had a lot of problems using CSRF and Django.</p>
  
  <p>Here is the context :<br/>
   - I've created a https website where user can upload files<br/>
   - I've used Django 1.4.2 to create this website<br/>
   - I've created an app *file_manager* that does what I want<br/>
   - I'm only using this app through the admin urls<br/></p>
  
  <p>If I disable <code>django.middleware.csrf.CsrfViewMiddleware</code> in the <code>MIDDLEWARE_CLASSES</code> of my <code>settings.py</code>, everything works just fine.<br/>
  I can upload a file on my template with cURL in command line under Debian Squeeze, the file hits the server, no problem.<br/>
  However, it seems it is not safe.</p>
  
  <p>So I enabled <code>django.middleware.csrf.CsrfViewMiddleware</code>
  It doesn't work anymore. I get all kind of errors regarding CSRF verification.</p>
  
  <p>I believe I've eliminated the usual suspects (I hope at least) :<br/>
   - <code>{% csrf_token %}</code><br/>
   - <code>RequestContext</code> <br/>
   - <code>CsrfViewMiddleware</code> in <strong>settings.py</strong></p>
  
  <p>You'll find below all the files (I hope) involved in the process :</p>
  
  <p><strong>views.py</strong></p>
  
  <pre><code>from django.http import HttpResponse, HttpResponseRedirect, Http404
  from django.template import Context, loader, RequestContext
  from django.shortcuts import render, get_object_or_404, redirect, render_to_response
  from django.core.urlresolvers import reverse
  
  from django.core.context_processors import csrf
  from django.views.decorators.csrf import csrf_exempt
  
  from file_manager.models import MyClass
  from file_manager.forms import MyClassForm
  
  def index(request):
      latest_file_list = MyClass.objects.order_by('-name')[:5]
      context = Context({
          'latest_file_list': latest_file_list,
      })
      return render(request, 'file_manager/index.html', context)
  
  def list(request):
      # Handle file upload
      if request.method == 'POST':
          form = MyClassForm(request.POST, request.FILES)
          if form.is_valid():
              newdoc = MyClass(name='testupl', filefield = request.FILES['docfile'], uploader='fcav')
              newdoc.save()
  
              # Redirect to the document list after POST
              return HttpResponseRedirect(reverse('file_manager.views.list'))
  
      else:
          form = MyClassForm() # A empty, unbound form
  
      # Load documents for the list page
      documents = MyClass.objects.all()
  
      # Render list page with the documents and the form
      con = {'documents': documents, 'form': form}
      con.update(csrf(request))
      return render_to_response(
          'list.html',
          con,
          context_instance=RequestContext(request)
      )
  </code></pre>
  
  <p><strong>list.html</strong></p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;html&gt;
      &lt;head&gt;
          &lt;meta charset="utf-8"&gt;
          &lt;title&gt;Minimal Django File Upload Example&lt;/title&gt;
      &lt;/head&gt;
      &lt;body&gt;
      &lt;!-- List of uploaded documents --&gt;
      {% if documents %}
          &lt;ul&gt;
          {% for document in documents %}
              &lt;li&gt;&lt;a href="{{ document.filefield.url }}"&gt;{{ document.filefield.name }}&lt;/a&gt;&lt;/li&gt;
          {% endfor %}
          &lt;/ul&gt;
      {% else %}
          &lt;p&gt;No documents.&lt;/p&gt;
      {% endif %}
  
          &lt;!-- Upload form. Note enctype attribute! --&gt;
          &lt;form action="{% url list %}" method="post" enctype="multipart/form-data"&gt;{% csrf_token %}
              &lt;p&gt;{{ form.non_field_errors }}&lt;/p&gt;
              &lt;p&gt;{{ form.docfile.label_tag }} {{ form.docfile.help_text }}&lt;/p&gt;
              &lt;p&gt;
                  {{ form.docfile.errors }}
                  {{ form.docfile }}
              &lt;/p&gt;
              &lt;p&gt;&lt;input type="submit" value="Upload" /&gt;&lt;/p&gt;
          &lt;/form&gt;
      &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>And here is my curl request :</p>
  
  <pre><code>    curl --cacert /home/fcav/apache.pem --user admin:password
  -e "https://domain.com/admin/" -X POST 
  -F "docfile=@/home/fcav/Downloads/basket.csv"
  https://domain.com/admin/file_manager/myclass/list/
  </code></pre>
  
  <p>I've tried many variations of the curl request by trying to send the cookie in the request as well, but now I think my mind is completely mixed up on how cURL handles the upload.</p>
  
  <p>All I get is CSRF Cookie not set or CSRF verification failed.</p>
  
  <p>If anyone knows cURL and Django enough to give me hints about how I can try to upload on my website without disabling CSRF, I would really appreciate it.</p>
  
  <p>Regards,
  Florian</p>