What is a CSRF attack (Cross-Site Request Forgery)?

Spoofing a server's IP address to redirect traffic Intercepting data exchanged between two machines on the network Injecting malicious SQL code into a form to access the database Forcing an authenticated user to unknowingly perform an unwanted action on a site they're already logged into.

What mechanism does Django use to protect against CSRF attacks?

A unique CSRF token included in each form An extra password required on every request Blocking all POST requests by default A CAPTCHA shown on every submission

Why isn't simple cookie-based session authentication enough to prevent CSRF?

The browser automatically sends existing cookies, even on requests triggered by a third-party site Session cookies expire too quickly Cookies are never encrypted Cookies are visible in the URL

Which type of HTTP request carries the most significant CSRF risk?

POST, PUT, DELETE (state-changing requests) GET only HEAD only OPTIONS only

What happens if the CSRF token is missing or invalid on a protected POST request in Django?

Django rejects the request with a 403 Forbidden error The request goes through normally but has no effect Django automatically generates a new token and retries The server redirects to the login page

What does the @csrf_exempt decorator on a Django view actually do?

Disable CSRF verification for that specific view Generate a more secure CSRF token Force HTTPS on that view Block requests coming from external domains