cal-itp
diff --git a/‎benefits/urls.py‎
Lines changed: 9 additions & 0 deletions b/‎benefits/urls.py‎
Lines changed: 9 additions & 0 deletions
diff --git a/‎benefits/views.py‎
Lines changed: 8 additions & 0 deletions b/‎benefits/views.py‎
Lines changed: 8 additions & 0 deletions
diff --git a/‎tests/pytest/test_views.py‎
Lines changed: 5 additions & 0 deletions b/‎tests/pytest/test_views.py‎
Lines changed: 5 additions & 0 deletions
@@ -65,10 +65,19 @@ def trigger_404(request):
     def trigger_500(request):
         raise Exception("Test 500")
 
+    def trigger_csrf(request):
+        if request.method == "POST":
+            return HttpResponse("Should not reach here")
+        return HttpResponse(
+            "<html><body><form method='post' action='/testcsrf/'>"
+            "<button type='submit'>Submit CSRF failure</button></form></body></html>"
+        )
+
     urlpatterns.append(path("test400/", trigger_400))
     urlpatterns.append(path("test403/", trigger_403))
     urlpatterns.append(path("test404/", trigger_404))
     urlpatterns.append(path("test500/", trigger_500))
+    urlpatterns.append(path("testcsrf/", trigger_csrf))
 
 if settings.RUNTIME_ENVIRONMENT() in (settings.RUNTIME_ENVS.LOCAL, settings.RUNTIME_ENVS.DEV):
     # simple route to read a pre-defined "secret"
 
@@ -30,6 +30,14 @@ def render_to_response(self, context, **response_kwargs):
         response_kwargs.setdefault("status", self.status_code)
         return super().render_to_response(context, **response_kwargs)
 
+    def post(self, request, *args, **kwargs):
+        """
+        Handle POST requests by treating them as GET requests.
+        This prevents 405 errors when error handlers are triggered
+        by failed POST submissions (common with CSRF failures).
+        """
+        return self.get(request, *args, **kwargs)
+
 
 class BadRequestView(BaseErrorView):
     """View handler for HTTP 400 Bad Request responses."""
 
@@ -63,6 +63,11 @@ def test_render_to_response__injects_status(self, view):
         response = view.render_to_response({})
         assert response.status_code == 420
 
+    def test_post_is_get(self, view, app_request_post, mocker):
+        spy = mocker.patch.object(view, "get")
+        view.post(app_request_post)
+        spy.assert_called_once()
+
 
 @pytest.mark.django_db
 class TestBadRequestView: