Home/ Questions/Q 665157
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-13T23:40:44+00:00

I have a Django webapp that has both a front-end, web-accessible component and an

  • 0

I have a Django webapp that has both a front-end, web-accessible component and an API that is accessed by a desktop client. However, now with the new CSRF middleware component, API requests from the desktop client that are POST’ed get a 403.

I understand why this is happening, but what is the proper way to fix this without compromising security? Is there someway I can signal in the HTTP header that it’s an API request and that Django shouldn’t be checking for CSRF or is that a bad strategy?

Edit–

The method I’m using at the moment is that the desktop client sets a header, X-Requested-With: XMLHttpRequest. This is kinda hacky, but I’m not sure how this would be handled better.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    How about just splitting off a view(s) for your desktop client and decorating them with csrf_exempt?

    • 0