# Forbidden (CSRF token missing or incorrect.) at /login/

- **ID:** `python/django-csrf-token-missing`
- **Domain:** python
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

Django's CSRF protection requires a valid CSRF token in POST requests; missing or invalid token causes 403 error.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 3.x | active | — | — |

## Workarounds

1. **Include CSRF token in template form** (95% success)
   ```
   In template: {% csrf_token %} inside the <form> tags.
   ```
2. **Use @csrf_exempt decorator on specific view** (85% success)
   ```
   from django.views.decorators.csrf import csrf_exempt
@csrf_exempt
def my_view(request): ...
   ```

## Dead Ends

- **Disabling CSRF globally** — Security risk; not recommended. (80% fail)
- **Adding @csrf_exempt to all views** — Weakens security; may not be appropriate. (70% fail)