Search code examples
djangohttpcsrfdjango-csrf

Django - No CSRF error for posts without token

I'm using Django to host a React application. I added the CSRF protection middleware in Django. I tried testing it by sending a http post with Postman, without the x-csrftoken in the header. To my surprise, I did not get a 403, but I was able to get data without the x-csrftoken. How is this possible? Below you find my CSRF settings. My additional Django settings are very straightforward and include CORS.

...
# Cross Origin Resource Sharing Protection
CORS_ALLOWED_ORIGINS = [
    'http://127.0.0.1:3000',
]
CORS_ORIGIN_ALLOW_ALL = False
CORS_ALLOW_CREDENTIALS = True
# Cross Site Request Forgery Protection
CSRF_TRUSTED_ORIGINS = []
MIDDLEWARE = [
    ...
    'django.middleware.csrf.CsrfViewMiddleware',
]
Solution

  • If you are using anything other than SessionAuthentication CSRF will be disabled. In the docs.