django-safeform

Django-safeform is a highly effective software that provides Cross-Site Request Forgery (CSRF) protection for Django, implemented at the form level. The most remarkable feature of this software is that it requires no middleware. There are two simple steps involved in protecting a Django form with Django-safeform.

Firstly, you need to wrap the form with the SafeForm class decorator which automatically adds a hidden csrf_token field to your form. This decorator also includes validation logic for checking if the csrf_token value is correct. It also slightly changes the signature of the form class. You can see an example of this below.

Secondly, you need to apply the @csrf_protect middleware to the view that contains the form to ensure that a _csrf_cookie is properly set. Once you have done all that, simply run the "./manage.py runserver" command in the examples folder, and you are good to go. You can also run the "./manage.py test" command in the same directory to run the unit tests.

For example usage, you can import the necessary classes, including SafeForm and csrf_protect, from Django. You can create a ChangePasswordForm class with two password input fields, wrap it with the SafeForm decorator, and apply the csrf_protect middleware to your view. Then, within your view, you can create an instance of ChangePasswordForm and check if it is valid. If it is, you can change the user's password and return an HttpResponse.

A: It's important to note that the constructor for the ChangePasswordForm class passes the entire request object, not just request.POST.
B: SafeForm conveniently takes care of binding your form to a set of input data. You no longer have to check if request.method == 'POST'.

If you're using a custom form template, you will have to remember to explicitly output the hidden csrf_token field in your template. However, if you use one of the form rendering helper methods like {{ form.as_p }}, SafeForm will automatically output the csrf_token field for you. A sample custom template is shown below:

{{ form.non_field_errors }}
New password {{ form.password }}.

Overall, Django-safeform is a valuable software that provides a secure solution to CSRF protection for Django at the form level without the need for middleware implementation.