title: 403 CSRF error on page refresh after login() Django?
body: <p>So the code is very simple:</p>
  
  <p>views.py</p>
  
  <pre><code>@csrf_protect
  def index(request):
      global userPersonalInformation
      if request.method == "POST":
          username = request.POST['username']
          password = request.POST['password']
          user = authenticate(username=username, password=password)
          if user is not None:
              login(request, user)
              profile = Profile.objects.get(username=username)
              return render(request, 'main/profile.html', {"profile":profile})
          else:
              if CheckUser(username, password):
                  user = User.objects.create_user(request.POST['username'], userPersonalInformation['email'], request.POST['password'])
                  user.save()
                  profile = Profile.objects.create(username=username,school=userPersonalInformation['school'],img=userPersonalInformation['img'], birthyear=userPersonalInformation['birthyear'],city=userPersonalInformation['city'],solved=progress['denominator'])
                  profile.save()
                  login(request, user)
                  return render(request, 'main/profile.html', {"profile": profile })
              else:
                  context = {"form": Userform(request.POST or None), }
                  return render(request, 'main/login.html', context)
      else:
          form = Userform()
          context = {"form": form, }
          return render(request, 'main/login.html', context)
  </code></pre>
  
  <p>profile.html</p>
  
  <pre><code>{% block title %}Profile | {{ user.first_name }}
  </code></pre>
  
  <p>And this displays Profile | username correctly on the title bar. i.e. User is logged in.</p>
  
  <p>Settings.py</p>
  
  <pre><code>MIDDLEWARE = [
      'django.middleware.security.SecurityMiddleware',
      'django.contrib.sessions.middleware.SessionMiddleware',
      'django.middleware.common.CommonMiddleware',
      'django.middleware.csrf.CsrfViewMiddleware',
      'django.contrib.auth.middleware.AuthenticationMiddleware',
      'django.contrib.messages.middleware.MessageMiddleware',
      'django.middleware.clickjacking.XFrameOptionsMiddleware',
  ]
  </code></pre>
  
  <p>main/urls.py</p>
  
  <pre><code>from django.conf.urls import url
  from . import views
  
  app_name = 'main'
  
  urlpatterns = [
      url(r'^$', views.index, name='index'),
  ]
  </code></pre>
  
  <p>login.html </p>
  
  <pre><code>{% extends "main/base.html" %}
  {% block title %}Sign in{% endblock %}
  {% block body %}
  &lt;div class="container"&gt;
      &lt;form method="post" action="" class="form-signin"&gt;
          &lt;h2 class="form-signin-heading"&gt;Please sign in&lt;/h2&gt;
          {% csrf_token %}
          {{ form.as_p }}
          &lt;button class="btn btn-primary" type="submit"&gt;Sign in&lt;/button&gt;
      &lt;/form&gt;
  &lt;/div&gt;
  {% endblock %}
  </code></pre>
  
  <p>form.py</p>
  
  <pre><code>from django import forms
  from django.contrib.auth.models import User
  
  
  class Userform(forms.Form):
      class Meta:
          model= User
          fields = ('username', 'password')
      username = forms.CharField()
      password = forms.CharField(widget=forms.PasswordInput())
  </code></pre>
  
  <p>Checkuser </p>
  
  <pre><code>CheckUser()
      return True
  </code></pre>
  
  <p>Now the problem is when I click sign in button, I am on the profile page with all the information displayed. But the moment I page refresh, I get this error:</p>
  
  <pre><code>Forbidden (403)
  CSRF verification failed. Request aborted.
  </code></pre>
  
  <p>Please help me. Profile is another table in the database which has the contents of user. The primary key for both tables user and profile is the username. The function CheckUser if user is a valid user of another website which I'm crawling.If he is, we save his details to our database and userPersonalInformation is a global dictionary.</p>
  
  <p>Django Version 1.10</p>