Django Caching with CSRF Tokens

Yes, this is expected behavior. When you include a {% csrf_token %} in your template, Django generates a unique token for each user session. Since this token changes between users and sessions, it prevents the page from being effectively cached.

Solutions

There are a few approaches to handle this situation:

1. Use JavaScript to fetch the CSRF token

Instead of including the CSRF token directly in your template, you can:

1. Cache the page without the token
2. Use JavaScript to fetch the token and insert it into your forms

JAVASCRIPTCopied
document.addEventListener('DOMContentLoaded', function() {
    // Get the CSRF token from the cookie
    function getCookie(name) {
        let cookieValue = null;
        if (document.cookie && document.cookie !== '') {
            const cookies = document.cookie.split(';');
            for (let i = 0; i < cookies.length; i++) {
                const cookie = cookies[i].trim();
                if (cookie.substring(0, name.length + 1) === (name + '=')) {
                    cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
                    break;
                }
            }
        }
        return cookieValue;
    }
    
    // Insert CSRF token into all forms
    const csrftoken = getCookie('csrftoken');
    const forms = document.querySelectorAll('form');
    
    forms.forEach(function(form) {
        const input = document.createElement('input');
        input.type = 'hidden';
        input.name = 'csrfmiddlewaretoken';
        input.value = csrftoken;
        form.appendChild(input);
    });
});

2. Use the @vary_on_cookie decorator

You can use the @vary_on_cookie decorator along with @cache_page to cache different versions of the page based on the user's cookie:

PYTHONCopied
from django.views.decorators.cache import cache_page, vary_on_cookie
from django.views.decorators.csrf import csrf_protect

@cache_page(60 * 15)  # Cache for 15 minutes
@vary_on_cookie
@csrf_protect
def my_view(request):
    # Your view code

This will cache a separate version of the page for each user, which maintains security but reduces the effectiveness of caching.

3. Use template fragment caching

If the search box is the only part of your page that needs the CSRF token, you could use template fragment caching for the rest of the content:

DJANGOCopied
{% load cache %}

{% cache 600 header_content %}
  {# Header content without CSRF token #}
{% endcache %}

<form method="post" action="/search/">
  {% csrf_token %}
  {# Search form fields #}
</form>

{% cache 600 main_content %}
  {# Main content without CSRF token #}
{% endcache %}

This approach allows you to cache most of your page while keeping the CSRF protection for your forms.