title: Using @csrf_exempt and creating a CSRF token in the same view
body: <p>I am expecting a <code>POST</code> from a 3rd party server.  I understand that I need to use the <code>@csrf_exempt</code> decorator to allow for a post from a 3rd party server.  I'm using Django 1.4 and Python 2.7 on Ubuntu 12.04.</p>
  
  <p>Now, my view is going to generate an un-bound form that will contain fields for a user to populate as well as hidden fields containing information from the original <code>POST</code>.  So, the first <code>POST</code> will initiate a second <code>POST</code>.</p>
  
  <p>The second <code>POST</code> is going to be sent from my server to another view on my server.  I'm trying to figure out how to generate a <code>CSRF</code> token for my form.</p>
  
  <p>I'm trying to do exactly what I've read in the <a href="https://docs.djangoproject.com/en/dev/ref/contrib/csrf/?from=olddocs#how-to-use-it" rel="nofollow">documentation</a>.</p>
  
  <p>My code from views.py:</p>
  
  <pre><code>from django.core.context_processors import csrf
  from django.shortcuts import render_to_response
  from gateway_interface.post_handling import PostHandling
  
  @csrf_exempt
  def requestNewPaymentInfo(request):
  
      c = {}
      c.update(csrf(request))
  
      # Gather information posted
      if (request.method == "POST"):
          # Create the initialization dictionary based on POST values
          postHandling = PostHandling()
          post_dict = postHandling.createDictionary(request)
  
          # Create the form
          form = addPaymentForm(initial = post_dict)
  
          return render_to_response('requestNewPaymentInfo.html', { 'form' : form }, c)
  </code></pre>
  
  <p>What do you do on the template side now?!?  Again, from the documentation I thought I should do the following:</p>
  
  <pre><code>&lt;form action="/addPayment/" method="post"&gt;
     {% csrf_token %}
  &lt;/form&gt;
  </code></pre>
  
  <p>I test this by doing a <code>POST</code> from a 3rd party server.  Sometimes I see the form fully generated with what appears to be a valid <code>CSRF</code> token.</p>
  
  <p>Sometimes I see a failure that looks like this:</p>
  
  <pre><code>Django Version: 1.4
  Python Version: 2.7.3
  Installed Applications:
  ('django.contrib.auth',
   'django.contrib.contenttypes',
   'django.contrib.sessions',
   'django.contrib.sites',
   'django.contrib.messages',
   'django.contrib.staticfiles',
   'django.contrib.admin',
   'gateway_interface')
  Installed Middleware:
  ('django.middleware.common.CommonMiddleware',
   'django.contrib.sessions.middleware.SessionMiddleware',
   'django.middleware.csrf.CsrfViewMiddleware',
   'django.contrib.auth.middleware.AuthenticationMiddleware',
   'django.contrib.messages.middleware.MessageMiddleware')
  
  
  Traceback:
  File "/usr/local/lib/python2.7/dist-packages/django/core/handlers/base.py" in get_response
    111.                         response = callback(request, *callback_args, **callback_kwargs)
  File "/usr/local/lib/python2.7/dist-packages/django/views/decorators/csrf.py" in wrapped_view
    77.         return view_func(*args, **kwargs)
  File "/home/tokeniz/tokeniz/gateway_interface/views.py" in requestNewPaymentInfo
    64.         return render_to_response('requestNewPaymentInfo.html', { 'form' : form }, c)
  File "/usr/local/lib/python2.7/dist-packages/django/shortcuts/__init__.py" in render_to_response
    20.     return HttpResponse(loader.render_to_string(*args, **kwargs), **httpresponse_kwargs)
  File "/usr/local/lib/python2.7/dist-packages/django/template/loader.py" in render_to_string
    178.         context_instance.pop()
  
  Exception Type: TypeError at /requestNewPaymentInfo/
  Exception Value: pop expected at least 1 arguments, got 0
  </code></pre>
  
  <p>Then I will eventually get this error:</p>
  
  <pre><code>Forbidden (403)
  CSRF verification failed. Request aborted.
  </code></pre>
  
  <p>Once I receive the <code>CSRF verification failed</code> error I will continue to get this error until I clear the cookies and start over.</p>
  
  <p>Can anyone tell me what I'm doing wrong?  I can see it has something to do with how I generate the <code>CSRF</code> token.  I don't understand how the process works based on what is in the documentation.  What is <code>c</code> in my view?  An empty dictionary that I'm populating with information and passing to <code>render_to_response</code>.  Ok, but how is that being used in the template?</p>
  
  <p>Should my template have something like this:</p>
  
  <pre><code>&lt;form action="/addPayment/" method="post"&gt;
     {% c.csrf_token %}
  &lt;/form&gt;
  </code></pre>
  
  <p>If not, why?  How does Django know that this <code>c</code> contains the <code>CSRF</code> token?</p>
  
  <p>Any help would be greatly appreciated.</p>