Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
Django requires it so ajax posts to the server require CSRF protection. But CSRF requires cookies to be enabled or django will 404 the request. Assuming that nobody has cookies enabled, how should I handle my ajax posts? I don’t want to use the @exempt_csrf decorator for security issues.
(Not sure if csrf protection is even needed for what i’m doing, the ajax requests are just for upvoting and downvoting posts like on this website)
Thank you guys!
Django’s in-built CSRF protection will not work without cookies.
https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#how-it-works
You need to roll your own CSRF protection for these views, if you decide it is required. Or use something like https://github.com/mozilla/django-session-csrf (per Abid A’s answer, the session framework require cookies so this won’t help in your case.)