Django Rest Framework remove csrf

by

Note: Disabling CSRF is unsafe from security point of view. Please use your judgement to use the below method.

Why this error is happening?

This is happening because of the default SessionAuthentication scheme used by DRF. DRF’s SessionAuthentication uses Django’s session framework for authentication which requires CSRF to be checked.

When you don’t define any authentication_classes in your view/viewset, DRF uses this authentication classes as the default.

'DEFAULT_AUTHENTICATION_CLASSES'= (
    'rest_framework.authentication.SessionAuthentication',
    'rest_framework.authentication.BasicAuthentication'
),

Since DRF needs to support both session and non-session based authentication to the same views, it enforces CSRF check for only authenticated users. This means that only authenticated requests require CSRF tokens and anonymous requests may be sent without CSRF tokens.

If you’re using an AJAX style API with SessionAuthentication, you’ll need to include a valid CSRF token for any “unsafe” HTTP method calls, such as PUT, PATCH, POST or DELETE requests.

What to do then?

Now to disable csrf check, you can create a custom authentication class CsrfExemptSessionAuthentication which extends from the default SessionAuthentication class. In this authentication class, we will override the enforce_csrf() check which was happening inside the actual SessionAuthentication.

from rest_framework.authentication import SessionAuthentication, BasicAuthentication 

class CsrfExemptSessionAuthentication(SessionAuthentication):

    def enforce_csrf(self, request):
        return  # To not perform the csrf check previously happening

In your view, then you can define the authentication_classes to be:

authentication_classes = (CsrfExemptSessionAuthentication, BasicAuthentication)

This should handle the csrf error.

More Related Contents:

  1. What is the right way to use angular2 http requests with Django CSRF protection?
  2. “CSRF token missing or incorrect” while post parameter via AJAX in Django
  3. Django rest framework, use different serializers in the same ModelViewSet
  4. How do I create multiple model instances with Django Rest Framework?
  5. Django rest framework nested self-referential objects
  6. Custom error messages in Django Rest Framework serializer
  7. Django REST Framework: adding additional field to ModelSerializer
  8. How to change field name in Django REST Framework
  9. How do you use the django-filter package with a list of parameters?
  10. Django Rest Framework: Dynamically return subset of fields
  11. Django Rest Framework with ChoiceField
  12. SocketException: OS Error: Connection refused, errno = 111 in flutter using django backend
  13. How to set current user to user field in Django Rest Framework?
  14. Forbidden (403) CSRF verification failed. Request aborted. Even using the {% csrf_token %}
  15. “Post Image data using POSTMAN”
  16. Django CSRF framework cannot be disabled and is breaking my site
  17. CSRF Failed: CSRF token missing or incorrect
  18. How to register users in Django REST framework?
  19. CSRF with Django, React+Redux using Axios
  20. How do you filter a nested serializer in Django Rest Framework?
  21. CSRF verification failed. Request aborted
  22. How to get Request.User in Django-Rest-Framework serializer?
  23. Pass request context to serializer from Viewset in Django Rest Framework
  24. Django Rest Framework: Disable field update after object is created
  25. Token Authentication for RESTful API: should the token be periodically changed?
  26. How to programmatically call a Django Rest Framework view within another view?
  27. Django REST Framework image upload
  28. CSRF validation does not work on Django using HTTPS
  29. How can I test binary file uploading with django-rest-framework’s test client?
  30. context in nested serializers django rest framework

Leave a Comment