Q:

understanding csrf in django hidden field in form and CSRFCookie

I am writing down my understanding of the csrf protcetion mechanism in django.Please correct me if it is faulty.
The csrfViewMiddleware  creates a unique string and stores it in a hidden field 'csrfmiddlewaretoken' of a form originating from the host.Since a malicious website mimicking this form will not know about the value of this field,it cannot use it.
When someone tries to post a form,the website checks the 'csrfmiddlewaretoken' field and its value.If it is wrong or not set,then a csrf attempt is detected.
But then ,what exactly is the CSRFCookie? The doc says the unique value is set in CSRFCookie and also in the hidden field.This is where I am confused.Does a cookie get sent to the browser with the unique string embedded?I wish someone can explain this a bit clearly.
thank you,

A:

Ok, so here goes my explanation:
Django assigns an authenticated user a CSRF token that is stored in a cookie. The value in this cookie is read every time a user makes a request that is considered "unsafe" (namely POST, PUT, DELETE) in order to validate that the user, not a malicious third-party, is making the request.
The CSRF tag you place in a form actually grabs the CSRF token from the cookie and then passes it in as a POST variable when you submit a form.
Hopefully that makes it a little clearer.

