CSRF protection prevents a third-party site from making a logged-in user send an unwanted request. Django adds a middleware that requires a secret token in every POST form; you insert it with the {% csrf_token %} tag. Without it, the request is rejected with a 403 error.
Example
<form method="post">
{% csrf_token %}
...
</form>