Django Rest Framework, CSRF not Working in POST requests with Postman

Question

My app uses django rest_framework and SessionAuthentication. I can login successfully and have session id and csrf token set in cookie. However, POST request still complains CSRF failure.

Login with rest_framework BasicAuthentication; session id and csrf token are set cookie
copy and paste csrf token value to Post request header with key "X-CSRFTOKEN" and value from cookie.
django.middleware.csrf.CsrfViewMiddleware are in Middleware classes in settings.py

I test with Postman and got

{"detail":"CSRF Failed: CSRF token missing or incorrect."}

class ApiLoginView(APIView):

  authentication_classes = (BasicAuthentication, )
  permission_classes = (IsAuthenticated,)

  def post(self, request, *args, **kwargs):
    # use django.contrib.auth.login
    login(request, request.user)
    user = request.user
    return Response("login success")

class ApiUserView(APIView):

  authentication_classes = (SessionAuthentication,)
  permission_classes = (IsAuthenticated,)

  def post(self, request):
    return Response("ApiUser Post Success")

Is Postman a correct tool for testing? this seems to be a similar problem in Postman
Any thing I am missing? and what are the options for me to test django_rest_framework.

Sorry it seems to be a common problems but I cannot find work it through after reading related posts.

Try clear cookies! csrf exempt by default in DRF. But postman included csrf token if it is found in Cookies so that error. May be clear cookies after login and make post call. Also check with curl without csrf. It may works... — Raja Simon
– Raja Simon, Commented Jun 7, 2017 at 8:24
@RajaSimon DRF explicitly checks the CSRF token when using session authentication. If you don't use a token, DRF will certainly reject the request. — knbk
– knbk, Commented Jun 7, 2017 at 10:24
I had that problem a few days back. You need a valid refferer. The error can be misleading sometimes. — William R. Marchand
– William R. Marchand, Commented Jun 7, 2017 at 19:31
@RajaSimon I removed csrf token from cookie and POST request still doesn't work. To my understanding, DRF session authentication checks CSRF. And CSRF compares the value of csrf token between request header and cookie value. We need csrf token in both cookie and header to make it work. Is it correct? — YSC
– YSC, Commented Jun 8, 2017 at 2:44
@WilliamR.Marchand Thanks. How to set correct refferer in Postman? Could you please share how to get around of it in Postman or other API testing platform? — YSC
– YSC, Commented Jun 8, 2017 at 2:48

KenBuckley · Accepted Answer · 2022-05-31 12:35:06Z

You can indeed use Postman to test Django Rest Framework using session authentication. And it would appear that the OP has ticked all the boxes. However as a check list I offer this set of steps, which work for me.

When using DRF, Postman and django Session Authentication you need to configure your postman client as follows (note the values for the X-CSRFToken and sessionid come from a cookie viewer in your browser-open the cookie viewer and copy out the values) :

set the headers in Postman as follows (in this case its a PATCH but could as easily be a POST):
Again in Postman set the Body to be raw and insert the JSON data to be sent as follows: Here I am changing the telephone number for the client.

{ "telefone": "42-42424242"

}
Set up a cookie called csrftoken and a cookie called sessionid

The csrf cookie should have the same value as the X-CSRFToken header in step 1, i.e.

With these three elements in place, and your DRF correctly configured you should be good to go. In settings for DRF check that SessionAuthentication is included :

REST_FRAMEWORK = {
'DEFAULT_AUTHENTICATION_CLASSES': (
    'rest_framework.authentication.SessionAuthentication',
),....

Collectives™ on Stack Overflow

Django Rest Framework, CSRF not Working in POST requests with Postman

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related