I am calling obtain.auth_token from urls as follows
url(r'^api-token/','rest_framework.authtoken.views.obtain_auth_token')
I get back
{
detail: "CSRF Failed: CSRF token missing or incorrect."
}
I am wondering why this happends as I was under the impression django-rest-framework was usualy CSRF exempt
Thanks
That view uses a POST. DRF always requires CSRF for session-authenticated POST's.
Sensitive requests like getting an auth token should use POST for just this reason.
I had the exact same issue. Check if you have sign out of the browser.
I just ran into this too. Adding an answer in case this was unclear to anyone else.
api-token endpoint correctly. I was initially trying to use Basic Auth, assuming this token-generating view was protected, but DRF actually expects form data containing username and password fields instead.Here's a working example using requests:
r = requests.post('http://example.com/api-token/'), data={
'username': username,
'password': password,
})
token = r.json()['token']
In order with the documentation http://www.django-rest-framework.org/topics/ajax-csrf-cors/ you have to implement ajax-csrf how is explanied in https://docs.djangoproject.com/en/dev/ref/csrf/#ajax
... if you are using angularjs you can check it Django csrf token + Angularjs
