Skip to main content
AI Assist is now on Stack Overflow. Start a chat to get instant answers from across the network. Sign up to save and share your chats.

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

6
  • 7
    As I mentioned in the question, I need to exempt the csrf token for the API application in order to allow other clients to consume the endpoints. The problem is not about AJAX requests, is about how to make that the Session Middleware works for other applications, i.e. mobiles, without removing it from the existing project. Commented Jan 18, 2017 at 17:13
  • Then you get it wrong. Token authentication or OAuth should be used for non browser clients. Commented Jan 18, 2017 at 21:10
  • 1
    I don't think you actually understand the question. An API is different than doing AJAX request. AJAX requests are for consuming the endpoints, NOT to create an API Commented Jan 18, 2017 at 23:08
  • Actually I don't think you got my point. API will respond to various requests, some of which may be AJAX. My point is that AJAX requests should be authenticated with the SessionAuthentication while other machine requests (iOS, Android, curl, wget or others) should be authenticated with token. Note that only SessionAuth requires a CSRF. Commented Jan 19, 2017 at 9:22
  • 1
    Sorry but I did, that's how I know that what you wrote in these comments it returns to the same question, does not solve it at all: How to make the CSRF disabled only for an API app?, and about the answer I found it already and post it as an answer in this same page. Commented Jan 19, 2017 at 19:23