0

I am using Django 1.4 to build a web service. My intention is to use it just as a web server (no browser involved), which means there's no form or template involved in the http request. I plan to use AJAX in the future but for now the client is just making requests using Python's request library. I'm getting the «CSRF verification failed. Request aborted» error. The documentation says I'm supposed to «add a CSRF token» to each http request when trying to POST, but I have no idea what this means.

Alasdair
  • 298,606
  • 55
  • 578
  • 516
Sofia Bravo
  • 579
  • 8
  • 22

1 Answers1

0

Check this answer, and this documentation page.

In short: Add a X-CSRFToken header in your POST request that holds the token.

Community
  • 1
  • 1
RickyA
  • 15,465
  • 5
  • 71
  • 95
  • I did, but the documentation does not help at all if you're not using Jquery (They just say add a CSRF token like I should know what that means), and the answer just points to the documentation page. – Sofia Bravo Sep 10 '13 at 07:42
  • @Sofia Bravo: how are you making POST requests to your django webserver endpoint now? – RickyA Sep 10 '13 at 07:48
  • Simply by doing: `import requests` `url = "http://..."` `answer = requests.post(url)` – Sofia Bravo Sep 10 '13 at 07:54
  • @SofiaBravo I think RickyA is asking about the ajax call in your template, how does it look like? – mariodev Sep 10 '13 at 08:57
  • @Sofia Bravo: If you are calling your post method from code you don't need crfs protection. This security is to prevent hijacking of a [**link on a website**](http://en.wikipedia.org/wiki/Cross-site_request_forgery). You do probably want user/api authentication, but that is something else. – RickyA Sep 10 '13 at 09:31
  • @dan-klasson: not js framework or html page is used. The POST request is done directly from python code running serverside. – RickyA Sep 10 '13 at 12:06
  • If you're not using any session based authentication, then just disable the csrf protection. There is a decorator called `@csrf_excempt` or something like that. – dan-klasson Sep 10 '13 at 15:18
  • I disabled CSRF authorization (using [this](http://stackoverflow.com/questions/1650941/django-csrf-framework-cannot-be-disabled-and-is-breaking-my-site)) since it was not necessary, thanks. – Sofia Bravo Sep 11 '13 at 16:16