title: Django: why CSRF_COOKIE in request.META
body: <p>I used <a href="http://docs.python-requests.org/en/master/" rel="nofollow">requests</a> to send request.</p>
  
  <pre><code>import requests
  
  def print(req):
      print('{}\n{}\n{}\n\n{}'.format(
          '-----------START-----------',
          req.method + ' ' + req.url,
          '\n'.join('{}: {}'.format(k, v) for k, v in req.headers.items()),
          req.body,
      ))
      print "----------END------------"
  
  try:
      req = requests.Request('GET',
              'https://myip/myproject/upload/token',
              headers={'Authorization': 'Token 401f7ac837a',
              })
      prepared = req.prepare()
      print(prepared)
  except Exception as e:
      print "Exception:", e
  </code></pre>
  
  <p>Output:</p>
  
  <pre><code>-----------START-----------
  GET https://myip/myproject/upload/token
  Authorization: Token 401f7ac837a
  
  None
  ----------END------------
  </code></pre>
  
  <p>But after I printed the request.META, there is </p>
  
  <pre><code>META:{u'CSRF_COOKIE': u'YGzoMaNEQJz1Kg8yXAwjJt6yNuT9L'
  </code></pre>
  
  <p><strong>What</strong> set the CSRF_COOKIE?
  <strong>Any comments welcomed. Thanks</strong></p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>(1)
  From the <a href="https://docs.djangoproject.com/en/1.9/ref/csrf/#how-it-works" rel="nofollow">doc</a>, it said <strong>This cookie is set by CsrfViewMiddleware</strong>, which means the CSRF cookie was set in back-end and set to front-end in the response (CSRF cookie: server -> browser). Why it also said <strong>For all incoming requests that are not using HTTP GET, HEAD, OPTIONS or TRACE, a CSRF cookie must be present</strong>? And why it appears in my request.META? (CSRF cookie: browser -> server ???)</p>
  
  <p>(2)
  It said **A hidden form field with the name ‘csrfmiddlewaretoken’ present in all outgoing POST forms. The value of this field is the value of the CSRF cookie.</p>
  
  <p>This part is done by the template tag.
  **</p>
  
  <p>When and How the template tag do it? </p>