Repository: zulip/zulip

Issue:
Customize CSRF error page
We should customize the error page shown to users when CSRF validation fails.  Currently, it looks like the default:

<img width="281" alt="django-csrf-failed" src="https://github.com/zulip/zulip/assets/28347/3253f653-08de-40e0-bc15-f0598aead89f">

We should [customize it](https://docs.djangoproject.com/en/dev/ref/settings/#csrf-failure-view) to:
 - Use the Zulip standard error template
 - Remove mention of `DEBUG=True`
 - Suggest that if they are using Safari private browsing mode or some other privacy-blocking extension, they may need to disable it.


Discussion:
Hello @zulip/server-misc members, this issue was labeled with the "area: misc" label, so you may want to check it out!

<!-- areaLabelAddition -->

@mateuszmandera You have been unassigned from this issue because you have not made any updates for over 14 days. Please feel free to reclaim the issue if you decide to pick up again. Thanks!

@zulipbot claim
Welcome to Zulip, @joanasouza! We just sent you an invite to collaborate on this repository at https://github.com/zulip/zulip/invitations. Please accept this invite in order to claim this issue and begin a fun, rewarding experience contributing to Zulip!

Here's some tips to get you off to a good start:

- Join me on the [Zulip developers' server](https://chat.zulip.org), to get help, chat about this issue, and meet the other developers.
- [Unwatch this repository](https://help.github.com/articles/unwatching-repositories/), so that you don't get 100 emails a day.

As you work on this issue, you'll also want to refer to the [Zulip code contribution guide](https://zulip.readthedocs.io/en/latest/contributing/index.html), as well as the rest of the developer documentation on that site.

See you on the other side (that is, the pull request side)!

@joanasouza You have been unassigned from this issue because you have not made any updates for over 14 days. Please feel free to reclaim the issue if you decide to pick up again. Thanks!

@zulipbot claim

Welcome to Zulip, @ntwari-bruce! We just sent you an invite to collaborate on this repository at https://github.com/zulip/zulip/invitations. Please accept this invite in order to claim this issue and begin a fun, rewarding experience contributing to Zulip!

Here's some tips to get you off to a good start:

- Join me on the [Zulip developers' server](https://chat.zulip.org), to get help, chat about this issue, and meet the other developers.
- [Unwatch this repository](https://help.github.com/articles/unwatching-repositories/), so that you don't get 100 emails a day.

As you work on this issue, you'll also want to refer to the [Zulip code contribution guide](https://zulip.readthedocs.io/en/latest/contributing/index.html), as well as the rest of the developer documentation on that site.

See you on the other side (that is, the pull request side)!

@ntwari-bruce You have been unassigned from this issue because you have not made any updates for over 14 days. Please feel free to reclaim the issue if you decide to pick up again. Thanks!

@alexmv By 'Zulip standard error template' you mean the 404.html template? We should add 403 status code in html file and use it for CSRF validation fail error?
@zulipbot claim


Resolving patch:
diff --git a/zerver/decorator.py b/zerver/decorator.py
--- a/zerver/decorator.py
+++ b/zerver/decorator.py
@@ -123,7 +123,7 @@ def wrapper(
                 return json_method_not_allowed(["POST"])
             else:
                 return TemplateResponse(
-                    request, "404.html", context={"status_code": 405}, status=405
+                    request, "4xx.html", context={"status_code": 405}, status=405
                 )
         return func(request, *args, **kwargs)
 
diff --git a/zerver/middleware.py b/zerver/middleware.py
--- a/zerver/middleware.py
+++ b/zerver/middleware.py
@@ -19,7 +19,6 @@
 from django.utils.deprecation import MiddlewareMixin
 from django.utils.log import log_response
 from django.utils.translation import gettext as _
-from django.views.csrf import csrf_failure as html_csrf_failure
 from django_scim.middleware import SCIMAuthCheckMiddleware
 from django_scim.settings import scim_settings
 from sentry_sdk import set_tag
@@ -454,7 +453,7 @@ def csrf_failure(request: HttpRequest, reason: str = "") -> HttpResponse:
     if RequestNotes.get_notes(request).error_format == "JSON":
         return json_response_from_error(CsrfFailureError(reason))
     else:
-        return html_csrf_failure(request, reason)
+        return render(request, "4xx.html", context={"csrf_failure": True}, status=403)
 
 
 class LocaleMiddleware(DjangoLocaleMiddleware):


Test patch: