learning-unlimited/ESP-Website — comment on commit 07ba05117e36874a4ee01cfb42122b1c68c3a23d
File: esp/public/media/scripts/csrf_check.js line 26
By gkanwar:

I didn't know if there were or weren't. I know that somewhere (I think for the dashboard) there's code to go through and add the csrfmiddlewaretoken afterwards via javascript, which my code may or may not affect, depending on when it's called. If I recall correctly though, it was AJAX stuff so it works fine (because AJAX checks on submit). One option could be to remove that code and just have my code add it to all forms (if that's the functionality that we want). Otherwise, if there was some way to override the onsubmit for non-AJAX forms, we could just check everything on submit (that way any csrfmiddlewaretokens that would be set already have been). I think if it's the case that all forms should be CSRF, the first option is the best. If that's not the case then I'm not sure... the second option sounds like it's not worth it.