Django/AngularJS: CSFR Token Error

Question

I'm new to both Django and AngularJS and I've been struggling on this for hours.

AngularJS Code (of my controller) to POST to Django Server:

$http({
    method: 'POST',
    url: 'http://127.0.0.1:8000/polls/', // This is the Django server IP
    data: {'string': 'body'}
    }).then(function successCallback(response) {
     $scope.var= "success";
  }, function errorCallback(response) {
    $scope.var= response; // To display error. 
     });

    }
})

Django Server Code (in view):

def index(request):
    return "true"

The exact error that I'm getting is: POST http://127.0.0.1:8000/polls/ 403 (Forbidden)

Details of error- CSRF verification failed. Request aborted.You are seeing this message because this site requires a CSRF cookie when submitting forms. This cookie is required for security reasons, to ensure that your browser is not being hijacked by third parties. Blah blah.

EDIT Would prefer solutions that would work without affecting any of the security provisions of Django

Yordano Gonzalez · Accepted Answer · 2017-06-16 19:15:44Z

2

You must include the token csrf in the header of the post call

    var csrf ='{{ csrf_token }}';
    $http({
        method: 'POST',
        headers: {'X-CSRFToken' : csrf },
        url: 'http://127.0.0.1:8000/polls/', // This is the Django server IP
        data: {'string': 'body'}
        }).then(function successCallback(response) {
         $scope.var= "success";
      }, function errorCallback(response) {
        $scope.var= response; // To display error. 
         });

        }
    })

or excempt csrf token for this call

from django.views.decorators.csrf import csrf_exempt

@csrf_exempt
def index(request):
    return "true"

answered Jun 16, 2017 at 19:15

Yordano Gonzalez

714 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Marin · Accepted Answer · 2017-06-16 13:12:47Z

0

If you have activate cors headers.

from django.views.decorators.csrf import csrf_exempt

@csrf_exempt
def index(request):
    return "true"

answered Jun 16, 2017 at 13:12

Marin

1,12114 silver badges34 bronze badges

2 Comments

Spade Over a year ago

Yes I've activated cords headers. But isn't there a way to do it without csrf_exempt, since I would like to keep it secure.

Spade Over a year ago

Also even when I try csrf_exempt, it leads to an internal server error

Collectives™ on Stack Overflow

Django/AngularJS: CSFR Token Error

2 Answers 2

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related