csrf fail on restAuth with TokenAuthentication and corsheaders - django

Question

I am trying to make auth apis for my django+react project. I have used restauth package. When I hit the api with postman, it is successful (200) on get request but fails on post request due to csrf, I looked on internet and disabled sessionauthentication but still in vain .Here is my settings.py minimal settings for restauth
INSTALLED_APPS = [
"django.contrib.admin",
"django.contrib.auth",
"django.contrib.contenttypes",
"django.contrib.sessions",
"django.contrib.messages",
"django.contrib.staticfiles",
"django.contrib.sites",
"whitenoise.runserver_nostatic"
]
LOCAL_APPS = [
"users.apps.UsersConfig",
"corsheaders",
]
THIRD_PARTY_APPS = [
"rest_framework",
"rest_framework.authtoken",
"rest_auth_custom",
"rest_auth_custom.registration",
"allauth",
"allauth.account",
"allauth.socialaccount",
"allauth.socialaccount.providers.google",
]
INSTALLED_APPS += LOCAL_APPS + THIRD_PARTY_APPS
MIDDLEWARE = [
'corsheaders.middleware.CorsMiddleware',
"django.middleware.security.SecurityMiddleware",
"django.contrib.sessions.middleware.SessionMiddleware",
"django.middleware.common.CommonMiddleware",
"django.middleware.csrf.CsrfViewMiddleware",
"django.contrib.auth.middleware.AuthenticationMiddleware",
"django.contrib.messages.middleware.MessageMiddleware",
"django.middleware.clickjacking.XFrameOptionsMiddleware",
"whitenoise.middleware.WhiteNoiseMiddleware",
]
CORS_ALLOW_CREDENTIALS = True
CORS_ALLOW_ALL_ORIGINS = True
CORS_ORIGIN_ALLOW_ALL = True
REST_FRAMEWORK = {
'DEFAULT_AUTHENTICATION_CLASSES': (
'rest_framework.authentication.TokenAuthentication',
# 'rest_framework.authentication.SessionAuthentication'
)
}
AUTHENTICATION_BACKENDS = (
"django.contrib.auth.backends.ModelBackend",
"allauth.account.auth_backends.AuthenticationBackend",
)
here is the postman view. let me know if you need anything additional

Answer 1

You need to add a header X-CSRFToken while requesting a method that can potentially change a state on the server-side. For example, POST, PUT, PATCH, DELETE etc.
"headers" : { "X-CSRFToken":"token" }
The value of X-CSRFToken is set by the server when the user is authenticated. The server uses a header named set-cookie having a name csrf and value somevalue that can be used later in X-CSRF-Token header. Here is a link to complete documentation.
https://docs.djangoproject.com/en/3.1/ref/csrf/#acquiring-the-token-if-csrf-use-sessions-and-csrf-cookie-httponly-are-false