diff --git a/addons/base_import_module/controllers/main.py b/addons/base_import_module/controllers/main.py
index 0d2cdc1ab5b..4b51e69f096 100644
--- a/addons/base_import_module/controllers/main.py
+++ b/addons/base_import_module/controllers/main.py
@@ -21,7 +21,7 @@ class ImportModule(Controller):
         if not is_admin:
             raise openerp.exceptions.AccessError("Only administrators can upload a module")
 
-    @route('/base_import_module/login', type='http', auth='none', methods=['POST'])
+    @route('/base_import_module/login', type='http', auth='none', methods=['POST'], csrf=False)
     @webservice
     def login(self, login, password, db=None):
         if db and db != request.db:
@@ -30,7 +30,9 @@ class ImportModule(Controller):
         if not uid:
             return Response(response="Wrong login/password", status=401)
         self.check_user(uid)
-        return "ok"
+        return Response(headers={
+            'X-CSRF-TOKEN': request.csrf_token(),
+        })
 
     @route('/base_import_module/upload', type='http', auth='user', methods=['POST'])
     @webservice
diff --git a/openerp/cli/deploy.py b/openerp/cli/deploy.py
index 7c5e9536c0c..2e97d838ec2 100644
--- a/openerp/cli/deploy.py
+++ b/openerp/cli/deploy.py
@@ -17,21 +17,24 @@ class Deploy(Command):
 
     def deploy_module(self, module_path, url, login, password, db='', force=False):
         url = url.rstrip('/')
-        self.authenticate(url, login, password, db)
+        csrf_token = self.authenticate(url, login, password, db)
         module_file = self.zip_module(module_path)
         try:
-            return self.upload_module(url, module_file, force=force)
+            return self.upload_module(url, module_file, force=force, csrf_token=csrf_token)
         finally:
             os.remove(module_file)
 
-    def upload_module(self, server, module_file, force=False):
+    def upload_module(self, server, module_file, force=False, csrf_token=None):
         print("Uploading module file...")
         url = server + '/base_import_module/upload'
-        files = dict(mod_file=open(module_file, 'rb'))
-        force = '1' if force else ''
-        res = self.session.post(url, files=files, data=dict(force=force))
-        if res.status_code != 200:
-            raise Exception("Could not authenticate on server '%s'" % server)
+
+        post_data = {'force': '1' if force else ''}
+        if csrf_token: post_data['csrf_token'] = csrf_token
+
+        with open(module_file, 'rb') as f:
+            res = self.session.post(url, files={'mod_file': f}, data=post_data)
+        res.raise_for_status()
+
         return res.text
 
     def authenticate(self, server, login, password, db=''):
@@ -47,6 +50,8 @@ class Deploy(Command):
         elif res.status_code != 200:
             raise Exception(res.text)
 
+        return res.headers.get('x-csrf-token')
+
     def zip_module(self, path):
         path = os.path.abspath(path)
         if not os.path.isdir(path):