Comments (5)
Yes please open another issue. I'm not sure but I think just disabling CSRF is the sensible thing, since we're explicitly allowing cross-site requests. Also most people use CORS to protect API's which take JSON, rather than html form data, which is what CSRF is mostly about protecting.
from django-cors-headers.
Is it failing on POST requests only? I had that problem and found that I had to add the csrf token from the API server to the AJAX request header named X-CSRFToken
. To get the token, in the API view I added the token to the response in a header.
from django-cors-headers.
@brad how did you solve this in the APIView? Some code snippet?
from django-cors-headers.
Django has some docs on adding this to all AJAX requests: https://docs.djangoproject.com/en/1.10/ref/csrf/#ajax
Hope that helps, closing this issue as it's old
from django-cors-headers.
Well, Django docs actually does not address this issue. There, it is suggested that you read the CSRF token from the cookie on the API server, but in a cors setting this is not possible.
That is, if I have two servers, API server and the cross-origin server, the cross-origin server cannot access the cookies of the API server, hence cannot set the X-CSRF header.
The only way I can think of is to add another endpoint to the API server that returns the CSRF token in a GET request, and then save that in the cross-origin server's code and use that in further POST requests, however that doesn't seem very secure according to https://github.com/pillarjs/understanding-csrf/
Also see pillarjs/understanding-csrf#6 .
Here, it seems to suggest that having a special endpoint for /csrf seems OK as long as we only allow CORS access from the cross-origin server we explicitly manage.
However, I am still not sure what the best way to deal with CSRF in a CORS setting. Should we just ignore CSRF for CORS? Some pointers in the docs regarding that would be helpful. I can open another issue for that if you like.
from django-cors-headers.
Related Issues (20)
- On Django 4.1, HOT 1
- 'CORS Missing Allow Origin' response despite settings aligned to documentation and links HOT 6
- i stll see this erorr Access to font at 'https://fra1.digitaloceanspaces.com/ewan-space/ewan/static/admin/fonts/Roboto-Regular-webfont.woff' from origin 'http://127.0.0.1:9000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. HOT 1
- Allow to have a list of patterns for `CORS_URLS_REGEX` HOT 1
- Listing Origin, DNT, or Accept-Encoding as allowed request headers is never necessary HOT 1
- No "Access-Control-Allow-Origin" in response despite all being set properly HOT 19
- Access-Control-Allow-Credentials absent from response headers HOT 1
- Django CORS issue with VUE HOT 1
- Request is lacking Cookie, csrftoken, sessionid after hitting the back. HOT 2
- How to set Access-Control-Allow-Origin for "chrome-extension://*" HOT 1
- Access to XMLHttpRequest from origin 'http://localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. HOT 1
- [help]Unable to set CORS headers after configuring the library HOT 6
- origin not in headers HOT 2
- Incompatible with Daphne under ASGI HOT 5
- check_request_enabled.send() should not be called from an async context HOT 2
- no "Access-Control-Allow-Origin" when open site from google HOT 4
- No "Access-Control-Allow-Origin" on fresh django project HOT 2
- CORS stop working on cloud editors like Gitpod HOT 1
- High Security Vulnerability on dependency (sqlparse version 0.4.4) with risk of Denial of Service HOT 1
- CSRF Errors with Cloudflare HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from django-cors-headers.