title: Sporadic 403 "CSRF FAILURECSRF cookie not set" errors with django
body: <p>We have a small site that is just starting to be exposed to the outside world.  For the most part it is working very well but we are occasionally getting 403 errors with the message "CSRF FAILURECSRF cookie not set" from one of the forms.  The form definitely has the <code>{% csrf_token %}</code> included, and our middleware looks like this:</p>
  
  <pre><code>MIDDLEWARE_CLASSES = (
      'django.middleware.csrf.CsrfViewMiddleware',
      'django.middleware.common.CommonMiddleware',
      'django.contrib.sessions.middleware.SessionMiddleware',
      'django.contrib.auth.middleware.AuthenticationMiddleware',
      'django.contrib.messages.middleware.MessageMiddleware',
  )
  </code></pre>
  
  <p>The form works fine for most people, but about once a day I get an e-mail with a failure case. The e-mail includes the actual request, which looks like this (I've removed the rest of the POST data to hide private data, but left the csrfmiddlewaretoken):</p>
  
  <pre><code>&lt;WSGIRequest
  path:/main/10/apply/,
  GET:&lt;QueryDict: {}&gt;,
  POST:&lt;QueryDict: {u'csrfmiddlewaretoken': [u'IQQZvbVIggJm6Be6VinPHj8Qn3i3TdmG']}&gt;,
  COOKIES:{},
  META:{'CONTENT_LENGTH': '111978',
   'CONTENT_TYPE': 'multipart/form-data; boundary=----WebKitFormBoundaryLyo9BPXnAwKnt8ew',
   'CSRF_COOKIE': 'XmSPWJZk2UwS4PNBXRmVlAaYDDdNaGqk',
  </code></pre>
  
  <p>The CSRF_COOKIE doesn't match the csrfmiddlewaretoken, which is what I'm assuming is causing the problem, but I can't figure out how these are out of sync for some submissions but not others.  The page is a pretty simple form with only a few fields.</p>
  
  <p>Any suggestions for where I should look?  I'm running the latest Django 1.4.1 on CentOS using mod_wsgi via apache.</p>
  
  <p><strong>Edit:</strong> The only other thing that seems odd compared to the successful requests is that here the <code>COOKIES:{}</code> section is empty, which would lead me to suspect that perhaps they just have disabled cookies in their browser, but then why does it show up with the CSRF_COOKIE in the META section?</p>
  
  <p>Thanks for your help!</p>
  
  <p>Brandon</p>