Both 403_csrf.html and 403.html should exist

[user52]

What happened?

The custom template (403.html) was not displayed for a 403 error. It was a csrf 403, not a regular 403 error.

What should've happened instead?

The 403.html template should have been displayed.

Additional details

Reproduce (all tests pass):

from unittest.mock import patch

from django.conf import settings
from django.test import Client, override_settings
from django.urls import reverse
from django.views import defaults as default_views


class TestCsrfTemplatesInUse:

    @override_settings(DEBUG=True)
    def test_403_csrf_debug_enabled(self):
        csrf_client = Client(enforce_csrf_checks=True)
        csrf_client.cookies.load({settings.CSRF_COOKIE_NAME: "notavalidtoken"})
        response = csrf_client.post(reverse("account_login"))
        # Show that CSRF_FAILURE_TEMPLATE is unexpectedly being used instead of using the project's custom "403.html".
        # https://github.com/django/django/blob/main/django/views/csrf.py#L15-L100
        assert 'CSRF verification failed. Request aborted.' in str(response.content)

    @override_settings(DEBUG=False)
    def test_403_csrf_debug_disabled(self):
        csrf_client = Client(enforce_csrf_checks=True)
        csrf_client.cookies.load({settings.CSRF_COOKIE_NAME: "notavalidtoken"})
        response = csrf_client.post(reverse("account_login"))
        # Show that CSRF_FAILURE_TEMPLATE is unexpectedly being used instead of using the project's custom "403.html".
        # https://github.com/django/django/blob/main/django/views/csrf.py#L15-L100
        assert 'CSRF verification failed. Request aborted.' in str(response.content)

    @patch("django.views.generic.base.TemplateView.get")
    def test_403_non_csrf(self, template_view_get):
        def get(request, *args, **kwargs):
            return default_views.permission_denied(request, Exception("Permission Denied"))
        template_view_get.side_effect = get

        client = Client()
        response = client.get(reverse("home"))
        # Show that non-csrf 403 errors are showing the 403.html template.
        assert response.templates[0].name == '403.html'

Fix:

$ cd {{cookiecutter.project_slug}}/{{cookiecutter.project_slug}}/templates/
$ cp 403.html 403_csrf.html

[user52]

with DEBUG=True (expected):

with DEBUG=False (production, 403_csrf.html shown, unexpected):

[infraredCoding]

@user52 is this issue still open? I'd love to take a look at it