title: Do I really need csrf_exempt in django app view?
body: <p>I have IdP initiated SSO setup where anyone browsing  <code>https://www.xxxxxx.com</code> get redirected for authentication to <code>https://www.yyyyyy.com</code> and after successful authentication host <code>yyyyyy.com</code> POST the SAML Response to callback URL <code>https://www.xxxxxx.com/SAML</code>.</p>
  
  <p>urls.py</p>
  
  <pre><code>url(r'^SAML$', views.index, name='index'),
  url(r'^home$', views.home, name='home'),
  url(r'^$', RedirectView.as_view(url='https://www.yyyyyy.com', permanent=True)),
  </code></pre>
  
  <p>views.py</p>
  
  <pre><code>@csrf_exempt
  def index(request):
      if request.method == 'POST':
          ...
          ...
          return redirect('/home')
      else:
          return redirect('/')
  
  
  @login_required(login_url='/')
  def home(request):
      return render(request, 'myapp/index.html')
  </code></pre>
  
  <p>settings.py</p>
  
  <pre><code>CSRF_TRUSTED_ORIGINS = ['yyyyyy.com']
  
  MIDDLEWARE_CLASSES = [
      'django.middleware.security.SecurityMiddleware',
      'django.middleware.cache.UpdateCacheMiddleware',
      'whitenoise.middleware.WhiteNoiseMiddleware',
      'django.contrib.sessions.middleware.SessionMiddleware',
      'django.middleware.common.CommonMiddleware',
      'django.middleware.common.BrokenLinkEmailsMiddleware',
      'django.middleware.csrf.CsrfViewMiddleware',
      'django.contrib.auth.middleware.AuthenticationMiddleware',
      'django.contrib.auth.middleware.SessionAuthenticationMiddleware',
      'django.contrib.messages.middleware.MessageMiddleware',
      'django.middleware.clickjacking.XFrameOptionsMiddleware',
      'django.middleware.cache.FetchFromCacheMiddleware',
  ]
  </code></pre>
  
  <p>Everything works when I use csrf_exempt on index view but if I remove csrf_exempt then I get <code>Cookie Not Set</code> error. I have 2 questions,</p>
  
  <ol>
  <li>Do I really need csrf_exempt on my index view? Or is there any other recommended way?</li>
  <li>Is the ordering for WhiteNoiseMiddleware and BrokenLinkEmailsMiddleware correct?</li>
  </ol>
  
  <p>I am using Django==1.9.5 and Python 3.5.1</p>