Forbidden (403) CSRF verification failed. Request aborted.
Django rejected a POST because the CSRF token was missing, wrong, or the request origin isn’t trusted.
Exact message you may see
CSRF verification failedCSRF token missingOrigin checking failed
Seen on:
Python
Meaning
Forms need {% csrf_token %}; AJAX needs the X-CSRFToken header. Since Django 4.0, HTTPS sites behind proxies also need CSRF_TRUSTED_ORIGINS with the scheme (https://example.com).
Common causes
- Form missing {% csrf_token %}
- AJAX request without X-CSRFToken
- Django 4+: origin not in CSRF_TRUSTED_ORIGINS
- Cookies blocked / CSRF cookie missing
- Proxy not setting X-Forwarded-Proto
⚡ Quick fix
- Add {% csrf_token %} inside POST forms
- Send the token header in fetch/axios
- Set CSRF_TRUSTED_ORIGINS = ["https://example.com"]
- Set SECURE_PROXY_SSL_HEADER behind HTTPS proxies
Detailed fix by platform
Python
CSRF_TRUSTED_ORIGINS = ["https://example.com", "https://www.example.com"]
How to diagnose
- Reason — The debug page gives the exact reason
- Origin — Listed in trusted origins?
🔧 Still not fixed?
Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:
Similar errors
Most viewed in Python
Other ways to find it
Where this error sits
Origin: Application & API. Errors that are often confused with or caused by this one (click to open):
🧠 Still stuck? Analyze your error
Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.
💬 What worked for others
No tips yet — did something else fix this for you?
Share what worked for you
Tips are checked by an editor before they appear. Links are removed.
Did this fix work for you?
Report a correction or suggest an improvement
Last updated 15 Oct 2026