@csrf_exempt does not work on generic view based class

Question

class ChromeLoginView(View): def get(self, request): return JsonResponse({'status': request.user.is_authenticated()}) @method_decorator(csrf_exempt) def post(self, request): username = request.POST['username'] password = request.POST['password'] user = authenticate(username=username, password=password) if user is not None: if user.is_active: login(request, user) return JsonResponse({'status': True}) return JsonResponse({'status': False})

I am expecting that the post does stopped by csrf, but it return 403 error.

But if remove that decorator and do this in the URLConf

url(r'^chrome_login/', csrf_exempt(ChromeLoginView.as_view()), name='chrome_login'),

it will work.

What happened here? didn't it supposed to work, because I guess that's what method_decorator do. I'm using python3.4 and django1.7.1

Any advice would be great.

It's super awesome! Especially since you can simply add the CsrfExemptMixin to your view to make this work. It's almost like cheating... — rnevius
– rnevius, Commented Dec 5, 2014 at 14:37
In my use case I am not using a form, so how can I still include a csrf token in my application? Like I am creating APIs hence a UI doesn't come into picture. So how can I make sure that CSRF token is still passed? — Apurva Kunkulol
– Apurva Kunkulol, Commented Sep 30, 2017 at 10:41
These answers won't work for DRF. See stackoverflow.com/questions/30871033/… — user3064538
– user3064538, Commented Aug 28, 2020 at 17:29

Lord Elrond · Accepted Answer · 2019-03-17 02:38:46Z

As @knbk said, this is the dispatch() method that must be decorated.

Since Django 1.9, you can use the method_decorator directly on a class:

from django.utils.decorators import method_decorator @method_decorator(csrf_exempt, name='dispatch') class ChromeLoginView(View): def get(self, request): return JsonResponse({'status': request.user.is_authenticated()}) def post(self, request): username = request.POST['username'] password = request.POST['password'] user = authenticate(username=username, password=password) if user is not None: if user.is_active: login(request, user) return JsonResponse({'status': True}) return JsonResponse({'status': False})

This avoids overriding the dispatch() method only to decorate it.

knbk · Accepted Answer · 2014-12-05 12:25:37Z

You need to decorate the dispatch method for csrf_exempt to work. What it does is set an csrf_exempt attribute on the view function itself to True, and the middleware checks for this on the (outermost) view function. If only a few of the methods need to be decorated, you still need to use csrf_exempt on the dispatch method, but you can use csrf_protect on e.g. put(). If a GET, HEAD, OPTIONS or TRACE HTTP method is used it won't be checked whether you decorate it or not.

class ChromeLoginView(View): @method_decorator(csrf_exempt) def dispatch(self, request, *args, **kwargs): return super(ChromeLoginView, self).dispatch(request, *args, **kwargs) def get(self, request): return JsonResponse({'status': request.user.is_authenticated()}) def post(self, request): username = request.POST['username'] password = request.POST['password'] user = authenticate(username=username, password=password) if user is not None: if user.is_active: login(request, user) return JsonResponse({'status': True}) return JsonResponse({'status': False})

vikas0713 · Accepted Answer · 2018-10-30 13:08:27Z

If you are looking for Mixins to match your needs, then you can create a CSRFExemptMixin and extend that in your view no need of writing above statements in every view:

class CSRFExemptMixin(object): @method_decorator(csrf_exempt) def dispatch(self, *args, **kwargs): return super(CSRFExemptMixin, self).dispatch(*args, **kwargs)

After that Extend this in your view like this.

class ChromeLoginView(CSRFExemptMixin, View):

You can extend that in any view according to your requirement, That's reusability! :-)

Cheers!

Llanilek · Accepted Answer · 2019-08-30 14:15:41Z

Django braces provides a CsrfExemptMixin for this.

from braces.views import CsrfExemptMixin class ChromeLoginView(CsrfExemptMixin, View): ...

Joshua Ramirez · Accepted Answer · 2024-01-12 18:47:30Z

You can achieve the desired results directly in the urls.py file related to the specific views.py app.

from django.views.decorators.csrf import csrf_exempt from django.urls import path urlpatterns = [path('validate-email', csrf_exempt(EmailValidationView.as_view())]

Then just use your class in your views.py normally.

Collectives™ on Stack Overflow

@csrf_exempt does not work on generic view based class

5 Answers 5

Comments

Comments

Comments

Comments

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

Comments

Comments

Comments

Comments

Comments

Linked

Related