title: Django CSRF Cookie Not Setting
body: <p>I have been trying to set up CSRF protection on my POST forms on my django 1.4.3 site and have been getting the 403 CSRF cookie not set error.</p>
  
  <p>I believe I have followed the doc in detail, followed advice on many forums but all to no avail. I have stripped back the code as much as possible and the cookie just does not set. The csrfmiddlewaretoken is present, so that's not the source of the problem. I'm at my wit's end. No doubt the answer is stupidly simple, I just need a fresh set of eyes to point it out to me...</p>
  
  <p>So here's some code:</p>
  
  <pre><code>#urls.py
  ...
  url(r'^csrf/$', csrf_test, name='csrf_test'),
  ...
  
  #views.py
  ...
  from django.views.decorators.csrf import csrf_protect
  
  @csrf_protect
  def csrf_test(request):
      c = {}
      c.update(csrf(request))
      return render_to_response('csrf.html', c)
  ...
  
  &lt;!-- csrf.html --&gt;
  &lt;html&gt;
  &lt;body&gt;
  &lt;form action="" method="post"&gt;
  {% csrf_token %}
  &lt;input name="Submit" value="Submit" type="submit"/&gt;
  &lt;/form&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  
  #settings.py
  ...
  MIDDLEWARE_CLASSES = (                
      'django.middleware.csrf.CsrfViewMiddleware',
      'django.middleware.common.CommonMiddleware',
      'django.contrib.sessions.middleware.SessionMiddleware',
      'django.contrib.auth.middleware.AuthenticationMiddleware',
      'django.contrib.messages.middleware.MessageMiddleware',
      #for db transactions. Check middleware order if faulty
      'django.middleware.transaction.TransactionMiddleware',
      # Uncomment the next line for simple clickjacking protection:
      # 'django.middleware.clickjacking.XFrameOptionsMiddleware',
      'debug_toolbar.middleware.DebugToolbarMiddleware',
  )
  ...
  TEMPLATE_CONTEXT_PROCESSORS = global_settings.TEMPLATE_CONTEXT_PROCESSORS + (
      'django.core.context_processors.csrf',
      'django.core.context_processors.request',
  )
  ...
  </code></pre>
  
  <p>I am running the django development server on 127.0.0.1:8000.</p>
  
  <p>I have cookies enabled on my browsers and have confirmed cookies are being set from other websites.</p>
  
  <p>I have checked the csrfmiddlewaretoken is being passed as a POST variable.</p>
  
  <p>I always get the error, this is not intermittent.</p>
  
  <p>I have no problem with POST forms when I have disabled the middleware/used @csrf_exempt.</p>
  
  <p>As I say, I'm at my wit's end. What on earth have I missed?</p>
  
  <p>Thanks</p>
  
  <p>Nathan</p>
  
  <p>EDIT:</p>
  
  <p>It now works, but I have no idea what has changed. For anyone reading this in the future I created a new project and app, it created the cookie straight away. Thinking it must have been a settings issue I changed the order of my MIDDLEWARE_CLASSES entries by moving 'django.middleware.csrf.CsrfViewMiddleware' down below 'django.contrib.sessions.middleware.SessionMiddleware'. I ran the original app and it worked. However to test whether the settings change was responsible I reversed the change. It still worked. Go figure.</p>
  
  <p>I hope this helps someone in the future FWIW.</p>
  
  <p>Nathan</p>