Having a POST'able API and Django's CSRF Middleware

django security api csrf
T. Stone picture T. Stone · Mar 8, 2010 · Viewed 19.8k times · Source

I have a Django webapp that has both a front-end, web-accessible component and an API that is accessed by a desktop client. However, now with the new CSRF middleware component, API requests from the desktop client that are POST'ed get a 403.

I understand why this is happening, but what is the proper way to fix this without compromising security? Is there someway I can signal in the HTTP header that it's an API request and that Django shouldn't be checking for CSRF or is that a bad strategy?

Edit--

The method I'm using at the moment is that the desktop client sets a header, X-Requested-With: XMLHttpRequest. This is kinda hacky, but I'm not sure how this would be handled better.

Answer

Brian Luft picture Brian Luft · Mar 9, 2010

How about just splitting off a view(s) for your desktop client and decorating them with csrf_exempt?

Related questions

Is it secure to store passwords as environment variables (rather than as plain text) in config files?

I work on a few apps in rails, django (and a little bit of php), and one of the things that I started doing in some of them is storing database and other passwords as environment variables rather than plain …

Read More
What's the purpose of Django setting ‘SECRET_KEY’?

I did a few google searches and checked out the docs ( https://docs.djangoproject.com/en/dev/ref/settings/#secret-key ), but I was looking for a more in-depth explanation of this, and why it is required. For example, what could …

Read More
How can I prevent SQL injection in PYTHON-DJANGO?

If a lamer input is inserted into an SQL query directly, the application becomes vulnerable to SQL injection, like in the following example: dinossauro = request.GET['username'] sql = "SELECT * FROM user_contacts WHERE username = '%s';" % username To drop the …

Read More