How do I make an HTTP request to Django Rest Framework with Session Authentication?

Question

I'm trying to access an API endpoint protected with DRF's session authentication. This requires passing the CSRF cookie in the request headers, which I have done following the Django docs, like this:

import * as Cookies from "js-cookie";
var csrftoken = Cookies.get('csrftoken');

fetch('/api/myendpoint', { headers: { 'X-CSRFToken': csrftoken }})
  .then(response => ...)

I have turned on session authentication in my settings.py like this:

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework.authentication.SessionAuthentication',
    ),
    'DEFAULT_PERMISSION_CLASSES': (
        'rest_framework.permissions.IsAuthenticated',
    )
}

Django login and authentication is working correctly for normal pages, but not for my API calls. I always get a 403 error with the response

Authentication credentials were not provided.

I have checked that the X-CSRFToken header value is correctly set to the current csrftoken cookie value by looking at the request in Chrome's network panel.

Jonathan Stray · Accepted Answer · 2017-05-08 19:34:44Z

1

Found the answer here. The csrftoken is not supposed to be in the request headers for GET. Instead,

fetch('/api/workflows', { credentials: 'include' })...

which includes cookies, as described in the Fetch docs.

X-CSRFToken must still be set for PUT, PATCH and DELETE requests

edited May 8, 2017 at 19:34

answered Feb 27, 2017 at 0:56

Jonathan Stray

2,9053 gold badges29 silver badges33 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How do I make an HTTP request to Django Rest Framework with Session Authentication?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related