CSRF Failed: CSRF token missing or incorrect

Question

I'm using Django 1.7 and django-rest-framework.

I made an API that returns me some JSON data putting this in my settings.py

REST_FRAMEWORK = {
    'DEFAULT_PERMISSION_CLASSES': ('rest_framework.permissions.AllowAny',),
    'DEFAULT_RENDERER_CLASSES': (
    #   'rest_framework.renderers.XMLRenderer',
    'rest_framework.renderers.JSONRenderer',
    #   'rest_framework.renderers.BrowsableAPIRenderer',
    )
}

When I make GET calls, it returns me all the data, but when I try with PUT/PATCH I get:

--------Response Headers---------
Status Code: 403
Date: Wed, 29 Oct 2014 18:51:42 GMT
Vary: Cookie
Server: WSGIServer/0.1 Python/2.7.8
Allow: GET, POST, PUT, PATCH, HEAD, OPTIONS
X-Frame-Options: SAMEORIGIN
Content-Type: application/json
---------------------------------

--------Response Body-----------
{"detail": "CSRF Failed: CSRF token missing or incorrect."}
---------------------------------

This only happens when I am logged in, if I am anonymous I can PUT/PATCH correctly.

I have tried with @csrf_exempt and I got errors, I have included the rest_framework.permissions.AllowAny in the setting...

I have no idea what's going on. Does anyone know what the issue is?

Kevin Brown-Silva · Accepted Answer · 2014-10-29T20:58:48.297

109

When you are using SessionAuthentication, you are using Django's authentication which usually requires CSRF to be checked. Django REST Framework enforces this, only for SessionAuthentication, so you must pass the CSRF token in the X-CSRFToken header.

The Django documentation provides more information on retrieving the CSRF token using jQuery and sending it in requests. The CSRF token is saved as a cookie called csrftoken that you can retrieve from a HTTP response, which varies depending on the language that is being used.

If you cannot retrieve the CSRF cookie, this is usually a sign that you should not be using SessionAuthentication. I recommend looking into TokenAuthentication or OAuth 2.0 depending on your needs.

edited Oct 29 '14 at 20:58

answered Oct 29 '14 at 20:19

Kevin Brown-Silva

39,112
40
199
230

1

I know I should give the CSRF Token when I am authenticated, but, actually I am using a .NET Windows Forms Application to communicate with this API, and it makes the GET call by HTTPRequest and HTTPResponse methods, I have no idea how could I get the CSRF Token in this situation, I am not using AJAX nor HTML Forms. **EDIT** The .NET app receives plain text in JSON format, and it return the same – Alex Lord Mordor Oct 29 '14 at 20:54
You are all right, with the cookie I can handle the csrftoken and put it back in the header data, so i can make PUT/PATCH calls if I am logged in. THANK YOU! – Alex Lord Mordor Oct 30 '14 at 19:14
@AlexLordMordor Can you explain a little bit your solution please? and why it didn't work when you were a logged-in user, but in annonymous ways it worked. (I have EXACTLY the same problem) – Alejo Bernardin Mar 30 '15 at 04:59
1

When you use SessionAuthentication, by default django requires two "keys" one of them could be found in the cookies when a logged-in user is active and the other is the csrf-token, if they do not match, then an error is raised, so, there is the documentation like @Kevin said to make it authenticate in the correct way. – Alex Lord Mordor Mar 31 '15 at 18:36
An other way to implement this can be found in this post: http://blog.kevinastone.com/getting-started-with-django-rest-framework-and-angularjs.html, in the section "Interlude: AngularJS + CSRF Protection". In this case using AngularJS – Alejo Bernardin Jun 11 '15 at 02:42
when I moved the 'django.middleware.csrf.CsrfViewMiddleware', before the 'django.contrib.sessions.middleware.SessionMiddleware', it stopped crying for the CSRF token for my DRF_extensions requests. `Django==2.1.7`, `djangorestframework==3.9.2`, `drf-extensions==0.4.0` – Искрен Станиславов Apr 01 '19 at 10:10
I just spent the last half hour trying to find the header key, `X-CSRFToken`. I tried literally everything else. Thank you! – Joe Sadoski Nov 23 '21 at 20:07

score 17 · Answer 2 · answered May 05 '18 at 15:31

This is what i did to solve it, i included csrf token to the form and using jquery/ javascrip got the csrf token like this when document loaded

var $crf_token = $('[name="csrfmiddlewaretoken"]').attr('value');

the included it on jquery headers as follow

 $.ajax({
            type: "POST",
            url: "/api/endpoint/",
            data: newEndpoint,
            headers:{"X-CSRFToken": $crf_token},
            success: function (newEnd) {
                console.log(newEnd);
                add_end(newEnd);
            },
            error: function () {
                alert("There was an error")
            }
        });

This works. In case anyone is wondering, the value for $crf_token comes from the csrftoken cookie picked up during Basic Auth login. — Randell S. Hynes, Aug 06 '20 at 21:36

Lane · Answer 3 · 2020-03-26T09:06:46.657

13

I think it is a cookie issue.

Permanent Solution: If you are using Postman, First, clear the existing cookies by clicking 'X' s. Then add correct cookie.

Temporary Solution (for debugging): Try this in your settings.py:

'DEFAULT_AUTHENTICATION_CLASSES': [
    # 'rest_framework.authentication.SessionAuthentication',
    'rest_framework.authentication.BasicAuthentication',
]

edited Mar 26 '20 at 09:06

answered Mar 26 '20 at 08:39

Lane

4,112
1
31
18

clear cookies solved my problem – ming Dec 13 '21 at 05:09

score 9 · Answer 4 · answered Oct 12 '18 at 15:12

9

1- Search for the Cookie header

2- Separate the csrftoken from the sessionid

3- Add the X-CSRFToken={..the csrftoken that you extracted in step 2..} see below

4- Post again

answered Oct 12 '18 at 15:12

Feras

2,105
27
22

score 4 · Answer 5 · answered Jun 10 '19 at 19:13

We had this problem and it turned out to be Postman's fault. They were automatically sending csrftoken and sessionid default values which we weren't passing in the header. Following this tutorial helped fix the issue: https://avilpage.com/2019/02/django-tips-csrf-token-postman-curl.html

score 3 · Answer 6 · answered Dec 13 '19 at 10:58

The easiest way to solve this error, I found on here. It works for me perfectly.

Steps:

Inherit the SessionAuthentication class:

from rest_framework.authentication import SessionAuthentication, BasicAuthentication 

class CsrfExemptSessionAuthentication(SessionAuthentication):

    def enforce_csrf(self, request):
        return  # To not perform the csrf check previously happening

Then in the APIView you have created, do this:

class Object(APIView):
    authentication_classes = (CsrfExemptSessionAuthentication, BasicAuthentication)

    def post(self, request, format=None):

This will keep you logged-in and your CSRF token will no longer be checked for this APIView.

And you've opened yourself up to CSRF attacks. – DylanYoung Nov 25 '21 at 03:45 — DylanYoung, Nov 25 '21 at 03:45

score 2 · Answer 7 · answered Feb 20 '18 at 07:03

2

I had similar problem, I've wrapped my URLs under csrf_exempt method as -

from django.views.decorators.csrf import csrf_exempt

url(r'^api/v1/some-resource$', csrf_exempt(SomeApiView.as_view())),

answered Feb 20 '18 at 07:03

Suyash Soni

211
2
9

score 2 · Answer 8 · answered Sep 22 '21 at 17:51

2

The simplest solution that worked for me is:

Add CSRF token in the headers of the AJAX POST call, and this can be done by including this one line of code

headers: { "X-CSRFToken": '{{csrf_token}}' },

And this line should be added above the success

answered Sep 22 '21 at 17:51

Mayur Gupta

243
2
14

Ruslan · Answer 9 · 2018-07-07T21:40:12.867

Get token from cookie:

function readCookie(name) {
    var nameEQ = name + "=";
    var ca = document.cookie.split(';');
    for(var i=0;i < ca.length;i++) {
        var c = ca[i];
        while (c.charAt(0)==' ') c = c.substring(1,c.length);
        if (c.indexOf(nameEQ) == 0) return c.substring(nameEQ.length,c.length);
    }
    return null;
}

var csrftoken = readCookie('csrftoken');

Send token in headers POST request:

  this.$http.post(server,{params: {foo: 'bar'}}, {headers: {"X-CSRFToken":csrftoken }}).then(function (response) {
            this.response = response.data;
        },
        function (response) {
            console.log(response);
        });

This is the only valid answer that has actual code. – nurettin Jun 15 '20 at 17:19 — nurettin, Jun 15 '20 at 17:19

score 1 · Answer 10 · answered Jul 08 '18 at 05:14

1

I had a similar problem where I'd wrapped the views with csrf_exempt and was still encountering errors. It turned out that I was getting the URL wrong, so it was resolved to a "not found" callback (which wasn't exempt from CSRF) and was hence throwing an exception before I could be told that the URL was wrong.

answered Jul 08 '18 at 05:14

kokociel

461
8
17

1

For me it was simply that I'd forgotten to add the trailing '/' to my URL. Like @kokociel said, the issue was nothing to do with CSRF and instead that the URL wasn't resolving to any of my endpoints. – Little Brain Jun 02 '19 at 11:40

score 1 · Answer 11 · answered Feb 05 '19 at 20:38

// USING AJAX TO UPDATE DATABASE THROUGH REST API
function getCookie(name) {
    var cookieValue = null;
    if (document.cookie && document.cookie !== '') {
        var cookies = document.cookie.split(';');
        for (var i = 0; i < cookies.length; i++) {
            var cookie = jQuery.trim(cookies[i]);
            if (cookie.substring(0, name.length + 1) === (name + '=')) {
                cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
                break;
            }
        }
    }
    return cookieValue;
}

var csrftoken = getCookie('csrftoken');

function csrfSafeMethod(method) {
    // these HTTP methods do not require CSRF protection
    return (/^(GET|HEAD|OPTIONS|TRACE)$/.test(method));
}

$.ajaxSetup({
    beforeSend: function (xhr, settings) {
        if (!csrfSafeMethod(settings.type) && !this.crossDomain) {
            xhr.setRequestHeader("X-CSRFToken", csrftoken);
        }
    }
});

Vishal Gupta · Answer 12 · 2021-01-06T13:11:14.017

1

this happened to me while testing rest-auth registration using postman this happened because postman was sending incorrect headers some old cookies and wrong content type i think it is some kind of a bug or i was ding it wrong

Solution: so i disabled the default headers

manually entered content type and the json body(POST request)

then re-enabled the required headers

edited Jan 06 '21 at 13:11

answered Jan 05 '21 at 20:33

Vishal Gupta

17
5

score 1 · Answer 13 · answered Dec 10 '21 at 08:29

1

I faced same issue while testing API in postman, I solved it by cleaning cache in Postman for that request.

answered Dec 10 '21 at 08:29

uc.uc

11
1

score 0 · Answer 14 · answered Dec 24 '18 at 02:23

When you host django website on Apache server. Djando rest framework with TokenAuthentication and SessionAuthentication will get

CSRF Failed: CSRF token missing or incorrect

To fix this open Apache configuration file - httpd.conf Add following line:

WSGIPassAuthorization On

Shah Vipul · Answer 15 · 2021-02-13T08:35:50.270

In settings.py file

INSTALLED_APPS = [
...
...
...
...
'rest_framework.authtoken',
...
]

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework.authentication.TokenAuthentication',
    ),
}

in project urls.py

from rest_framework.authtoken import views

urlpatterns = [
    ....
    path('api-token-auth/',views.obtain_auth_token,name='api-token-auth')

]

Open terminal as

$ pip3 install httpie
$ python3 manage.py createsuperuser # if not created
$ http POST http://localhost:8000/api-token-auth/ username="username" password = "password"   # You will get token key (Just copy it) ex:a243re43fdeg7r4rfgedwe89320

You token key will be also automatically saved in your databases

Go to postman header (like in example) Ex: screenshot from postman ,where and how to paste accessed toke

Then insert you token key.

You can take reference to get token key from this video

Kevin · Answer 16 · 2020-03-04T17:08:15.137

-7

django1.8 python2.7

{
    "detail": "CSRF Failed: CSRF token missing or incorrect."
}

I fix it by using other httpmethod; oh, I face it again, this time is because I paste it, there are some invisible characters

edited Mar 04 '20 at 17:08

answered Jan 22 '20 at 08:16

Kevin

31
3

5

[Here are a few tips on how to make your answer great](https://stackoverflow.com/help/how-to-answer) – Willie Cheng Jan 22 '20 at 09:07

CSRF Failed: CSRF token missing or incorrect

16 Answers16

Linked