{{ title }} (403)

{{ main }}

{% if no_referer %}

{{ no_referer1 }}

{{ no_referer2 }}

{{ no_referer3 }}

{% endif %} {% if no_cookie %}

{{ no_cookie1 }}

{{ no_cookie2 }}

{% endif %}
{% if DEBUG %}

Help

{% if reason %}

Reason given for failure:

    {{ reason }}
    
{% endif %} {% if bad_origin %} {% if forwarded_may_fix %}

The Origin header does not match the expected server origin, but common proxy headers are present in the request and may include parts of the Origin header.

If you’re sure that you are only running behind a secure proxy that always set these headers to avoid spoofing as described in this warning in the docs, you may wish to add one or more of the following settings to permit Django to trust these headers.

    SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
    USE_X_FORWARDED_HOST = True
  

{% else %} If the expected server origin looks correct, you may wish to add the origin to the CSRF_TRUSTED_ORIGINS setting. {% endif %} {% else %}

In general, this can occur when there is a genuine Cross Site Request Forgery, or when Django’s CSRF mechanism has not been used correctly. For POST forms, you need to ensure:

{% endif %}

You’re seeing the help section of this page because you have DEBUG = True in your Django settings file. Change that to False, and only the initial error message will be displayed.

You can customize this page using the CSRF_FAILURE_VIEW setting.

{% else %}

{{ more }}

{% endif %}