How to use CSRF security for a backend django for an mobile application client

user_13554909 0
Viewed 193

I'm developing a backend for a mobile app with Django where for user registration the user data are sent with the POST method. Since Django provide CSRF security as a middleware. Here my problem is if I have a front end I can enable CSRF token by jinja code as {% csrf_token %} but since it's a backend and how to resolve this problem

csrf backend django
2 Answers

One solution is to remove csrf token line form setting.py file :)

user_125355540

To guard against these type of attacks, you need to do two things: 1 Ensure that the 'safe' HTTP operations, such as GET, HEAD and OPTIONS cannot be used to alter any server-side state. 2 Ensure that any 'unsafe' HTTP operations, such as POST, PUT, PATCH and DELETE, always require a valid CSRF token. If you're using SessionAuthentication you'll need to include valid CSRF tokens for any POST, PUT, PATCH or DELETE operations. In order to make AJAX requests, you need to include CSRF token in the HTTP header, as described in the Django documentation.

Check this link. It explains exactly what your approach should be.

Basically you need to send csrf token in the header if you want the POST request to have csrf. But we do not ask for csrf tokens for non authenticated requests.

It would be better if you go with Django Rest Framework to create APIs if you aren’t already using it

user_95444030
Related