I have a simple API written with the Django REST framework, with CSRF protection enabled. In another app in the same project, I have a front-end which renders a CSRF token in the html page upon generation, and passes it in as a header in an AJAX fetch request. Without passing it that header in my JS file, the request returns a 403 error to the browser - as expected.
Why doesn't the same occur when I make a POST request to the same URL in postman? I receive the data from the API without sending a CSRF token as a header within postman.
I am running my Django project with the local runserver option on my localhost, and I am running postman on the same network. Is it because the requests are coming from the same network address that CSRF is not needed?