diff --git a/addons/base_import/static/src/xml/import.xml b/addons/base_import/static/src/xml/import.xml
index ae5c78c497d..7723f7b5266 100644
--- a/addons/base_import/static/src/xml/import.xml
+++ b/addons/base_import/static/src/xml/import.xml
@@ -2,6 +2,7 @@
     <t t-name="ImportView">
         <t t-set="_id" t-value="_.uniqueId('export')"/>
         <form action="" method="post" enctype="multipart/form-data" class="oe_import">
+            <input type="hidden" name="csrf_token" t-att-value="csrf_token"/>
             <input type="hidden" name="session_id"
                t-att-value="widget.session.session_id"/>
             <input type="hidden" name="import_id"/>
diff --git a/addons/web/static/src/js/framework/ajax.js b/addons/web/static/src/js/framework/ajax.js
index f8392287b26..d6619449a0f 100644
--- a/addons/web/static/src/js/framework/ajax.js
+++ b/addons/web/static/src/js/framework/ajax.js
@@ -1,6 +1,7 @@
 odoo.define('web.ajax', function (require) {
 "use strict";
 
+var core = require('web.core');
 var time = require('web.time');
 var utils = require('web.utils');
 
@@ -238,6 +239,11 @@ function get_file(options) {
             method: 'POST'
         }).appendTo(document.body);
     }
+    if (core.csrf_token) {
+        $('<input type="hidden" name="csrf_token">')
+                .val(core.csrf_token)
+                .appendTo($form_data);
+    }
 
     var hparams = _.extend({}, options.data || {}, {token: token});
     _.each(hparams, function (value, key) {
@@ -292,19 +298,16 @@ function post (controller_url, data) {
     };
 
     var Def = $.Deferred();
-    var compatibility = !(typeof(FormData));
-    var postData = compatibility ? new FormDataCompatibility() : new FormData();
+    var postData = new FormData();
     
     $.each(data, function(i,val) {
         postData.append(i, val);
     });
-
-    var xhr = new XMLHttpRequest();
-    if(compatibility) {
-        postData.setContentTypeHeader(xhr);
-        postData = postData.buildBody();
+    if (core.csrf_token) {
+        postData.append('csrf_token', core.csrf_token);
     }
 
+    var xhr = new XMLHttpRequest();
     if(xhr.upload) xhr.upload.addEventListener('progress', progressHandler(Def), false);
       
     var ajaxDef = $.ajax(controller_url, {
diff --git a/addons/web/static/src/xml/base.xml b/addons/web/static/src/xml/base.xml
index cae5392cf3b..0ce2ab0f08f 100644
--- a/addons/web/static/src/xml/base.xml
+++ b/addons/web/static/src/xml/base.xml
@@ -988,7 +988,8 @@
 <t t-name="HiddenInputFile">
     <div t-attf-class="oe_hidden_input_file #{fileupload_class or ''}" t-att-style="fileupload_style">
         <form class="o_form_binary_form" t-att-target="fileupload_id"
-            method="post" enctype="multipart/form-data" t-att-action="fileupload_action || '/web/binary/upload'">
+              method="post" enctype="multipart/form-data" t-att-action="fileupload_action || '/web/binary/upload'">
+            <input type="hidden" name="csrf_token" t-att-value="csrf_token"/>
             <input type="hidden" name="session_id" value="" t-if="widget.session.override_session"/>
             <input type="hidden" name="callback" t-att-value="fileupload_id"/>
             <t t-raw="0"/>
diff --git a/addons/web/views/webclient_templates.xml b/addons/web/views/webclient_templates.xml
index 6147e3d3a04..03723cf9a24 100644
--- a/addons/web/views/webclient_templates.xml
+++ b/addons/web/views/webclient_templates.xml
@@ -301,6 +301,13 @@
             <t t-call="web.layout">
                 <t t-set="head">
                     <t t-call-assets="web.assets_common"/>
+                    <script type="text/javascript">
+                        odoo.define('web.csrf', function (require) {
+                            var token = "<t t-esc="request.csrf_token(None)"/>";
+                            require('web.core').csrf_token = token;
+                            require('qweb').default_dict.csrf_token = token;
+                        });
+                    </script>
                     <t t-call-assets="web.assets_backend"/>
                     &lt;!--[if lte IE 9]&gt; <link rel="stylesheet" href="/web/static/src/css/ie.css"/> &lt;![endif]--&gt;
                     <script type="text/javascript">
diff --git a/addons/web_editor/static/src/xml/editor.xml b/addons/web_editor/static/src/xml/editor.xml
index 2146f916937..44abb32caf1 100644
--- a/addons/web_editor/static/src/xml/editor.xml
+++ b/addons/web_editor/static/src/xml/editor.xml
@@ -88,8 +88,7 @@
                   enctype="multipart/form-data"
                   target="fileframe"
                   class="form-inline">
-                  <!-- why is this template rendered client side? -->
-                <!-- input type="hidden" name="csrf_token" t-att-value="request.csrf_token()"/-->
+                <input type="hidden" name="csrf_token" t-att-value="csrf_token"/>
                 <div class="well">
                     <div class="form-group pull-left">
                         <input type="file" name="upload" t-att-accept="widget.accept" multiple="multiple" style="position: absolute; opacity: 0; width: 1px; height: 1px;"/>
diff --git a/addons/website/static/src/js/website.js b/addons/website/static/src/js/website.js
index ded64d27704..821223967c1 100644
--- a/addons/website/static/src/js/website.js
+++ b/addons/website/static/src/js/website.js
@@ -142,16 +142,23 @@ var error = function(data, url) {
     $error.modal('show');
 };
 
+function _add_input(form, name, value) {
+    var param = document.createElement('input');
+    param.setAttribute('type', 'hidden');
+    param.setAttribute('name', name);
+    param.setAttribute('value', value);
+    form.appendChild(param);
+}
 var form = function (url, method, params) {
     var form = document.createElement('form');
     form.setAttribute('action', url);
     form.setAttribute('method', method);
+
+    if (core.csrf_token) {
+        _add_input(form, 'csrf_token', core.csrf_token);
+    }
     _.each(params, function (v, k) {
-        var param = document.createElement('input');
-        param.setAttribute('type', 'hidden');
-        param.setAttribute('name', k);
-        param.setAttribute('value', v);
-        form.appendChild(param);
+        _add_input(form, k, v);
     });
     document.body.appendChild(form);
     form.submit();
diff --git a/addons/website/views/website_templates.xml b/addons/website/views/website_templates.xml
index 5a7735d1626..b56d76e8e53 100644
--- a/addons/website/views/website_templates.xml
+++ b/addons/website/views/website_templates.xml
@@ -130,6 +130,13 @@
             <t t-call-assets="website.assets_frontend" t-js="false"/>
             <t t-call-assets="web.assets_common" t-css="false"/>
             <t t-call-assets="website.assets_frontend" t-css="false"/>
+            <script type="text/javascript">
+                odoo.define('web.csrf', function (require) {
+                    var token = "<t t-esc="request.csrf_token(None)"/>";
+                    require('web.core').csrf_token = token;
+                    require('qweb').default_dict.csrf_token = token;
+                });
+            </script>
 
             <t t-raw="head or ''" name='layout_head'/>
         </head>