Question

I am a bit confused on how does the Authentication works in Django using pusher i want to implement a one-to-one chatting system so i guess i will be using private channels that requires authentication before you can subscribe to the channel … i read there that the endpoint is the url you want pusher to POST to, i added a url to test if it is working but every time the status returns 403 and it seems it doesn’t enter the view i created to test it so any ideas ? here is a sample of my code :

message.html

var channel = pusher.subscribe('private-test');
channel.bind('message', function(data) {
  var $message = $('<div class="message"/>').appendTo('#messages');
  $('<span class="user"/>').text(data.user).appendTo($message);
  $('<span/>').text(data.message).appendTo($message);
});;

Pusher.channel_auth_endpoint = 'test/'; 
Pusher.channel_auth_transport = 'ajax';

channel.bind('pusher:subscription_succeeded', function(status) {
    alert(status);
});

channel.bind('pusher:subscription_error', function(status) {
    alert(status);
});

Views.py:

def testUser(request,user_name):
print 'Test Passed'
return render_to_response('message.html', {
    'PUSHER_KEY': settings.PUSHER_KEY,'channel_variable':request.user.id,'other_var':'3', 
}, RequestContext(request)) 

when i checked the url it POSTs to, in my cmd i found it correct and it matched the one i put in urls.py but i still don’t know why it does not enter my view

Answer 1

I don’t know Django, but it seems highly likely that the framework is intercepting the call to prevent CSRF (Cross site resource forgery).

The Django docs talk about CSRF here:
https://docs.djangoproject.com/en/dev/ref/contrib/csrf/

As with a number of frameworks you’ll need to provide a CSRF token as part of the XHR/AJAX call to the authentication endpoint, or override the framework interception (somehow).

Have a look at the auth section of the Pusher constructor options parameter. In there you’ll find an example of how to pass a CSRF token.