Handling CSRF token when working with Django Rest Framework JWT

Question

Having the JWT token required for every request to the API, should I keep CSRF protection? Considering no one has access to other's jwtoken, of course.

If yes, how could I get the csrf token since I don't use django templates (I'm using Vue separately).

If not, is it ok to completely delete the CSRF middleware from settings?

Thanks in advance.

Paul Griffin · Accepted Answer · 2018-09-25 23:23:46Z

1

If you are storing the JWT in localStorage, you are not vulnerable to CSRF because localStorage cannot be accessed across domains. You should be aware, however, that there is debate as to whether it is wise to keep a JWT in localStorage since it can be stolen if you fall victim to XSS. The alternative is to store the token in a httpOnly cookie, in which case you must use CSRF protection.

answered Sep 25, 2018 at 23:23

Paul Griffin

1331 silver badge6 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

yogkm · Accepted Answer · 2018-09-22 06:46:27Z

1

If you're using Django, csrf_token will be in your site cookies. You can access it from cookies and pass it along with the request.

answered Sep 22, 2018 at 6:46

yogkm

6495 silver badges15 bronze badges

1 Comment

yierstem Over a year ago

I'm not using django templates at all, I don't have cookies or sessions from django's middlewares. The authentication is simply just taking the jwt token from (default: api-token-auth) and storing it into localStorage for further requests, that's all, no cookies involved. But now when I'm using django-rest-framework views to post data, it requires me that csrf token (isn't jwt token enough already?)

Collectives™ on Stack Overflow

Handling CSRF token when working with Django Rest Framework JWT

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related