Headless login with provider give cors error about django-allauth HOT 4 CLOSED

This part from the docs is important:

As calling this endpoint results in a user facing redirect (302), this call is only available in a browser, and must be called in a synchronous (non-XHR) manner.

You are using fetch -- just use a regular form POST (as in done in the demo code link above).

from django-allauth.

Bonus question: Why do i need to send X-CSRFToken?

"X-CSRFToken": Cookies.get("csrftoken"),

Without django logs Forbidden (CSRF token missing.): /_allauth/browser/v1/auth/provider/redirect. I would image allauth could take care of all that?

from django-allauth.

You do not need to send X-CSRFToken to pass the CSRF protection. Instead, you could attach the token to the request body.

login: async function() {
    await fetch("_allauth/browser/v1/auth/provider/redirect", {
        method: "POST",
        headers: {
            "Content-Type": "application/x-www-form-urlencoded"
        },
        body: new URLSearchParams({
            provider: this.type,
            callback_url: "/account/logged-in/",
            process: "login",
            csrfmiddlewaretoken: Cookies.get("csrftoken")
        })
    })
}

Since Discord disallows that header, try this option. I think it should work.

See for example, the demo code.

from django-allauth.

This part from the docs is important:

As calling this endpoint results in a user facing redirect (302), this call is only available in a browser, and must be called in a synchronous (non-XHR) manner.

You are using fetch -- just use a regular form POST (as in done in the demo code link above).

Thank you, the postForm worked. Yeah sorry, I read that documentation, but i didnt understand what non-XHR manner meant and didnt think to check it up.

from django-allauth.