Django REST Framework Forbidden CSRF cookie not set - django

Question

I have this view
from rest_framework import parsers, renderers
from rest_framework.authtoken.models import Token
from rest_framework.authtoken.serializers import AuthTokenSerializer
from rest_framework.response import Response
from rest_framework.views import APIView
from .serializers import EmailUserSerializer
from django.utils.decorators import method_decorator
from django.views.decorators.csrf import csrf_exempt
#method_decorator(csrf_exempt, name='post')
class ObtainAuthToken(APIView):
throttle_classes = ()
permission_classes = ()
parser_classes = (parsers.FormParser, parsers.MultiPartParser, parsers.JSONParser,)
renderer_classes = (renderers.JSONRenderer,)
serializer_class = AuthTokenSerializer
def post(self, request, *args, **kwargs):
serializer = self.serializer_class(data=request.data)
serializer.is_valid(raise_exception=True)
user = serializer.validated_data['user']
token, created = Token.objects.get_or_create(user=user)
user_serializer = EmailUserSerializer(user)
return Response({'token': token.key, 'user': user_serializer.data})
obtain_auth_token = ObtainAuthToken.as_view()
and this url
urlpatterns = [
url(r'^login/$',views.obtain_auth_token, name='get_auth_token'),
url(r'^login2/$',ObtainAuthToken, name='get_auth_token'),
]
i'm trying posting with postman like this:
127.0.0.1:8000/api/login2/
but i can only receive this error
Forbidden (CSRF cookie not set.): /api/login2/
[02/Jul/2017 22:49:11] "POST /api/login2/ HTTP/1.1" 403 2891
I know there are hundreds of post like this, I searched for a long time a solution but nothing seems working
tryied like this
urlpatterns = patterns('',
url('^login2/$', csrf_exempt(ObtainAuthToken)),
...
)
this
from django.utils.decorators import method_decorator
class LoginView(APIView):
#method_decorator(csfr_exempt)
def dispatch(self, *args, **kwargs):
...
and also this
from django.utils.decorators import method_decorator
#method_decorator(csrf_exempt, name='dispatch')
class LoginView(APIView):
...
and this
#method_decorator(csrf_exempt, name='post')
class ObtainAuthToken(APIView):
throttle_classes = ()
...
#csrf_exempt
def post(self, request, *args, **kwargs):
serializer = self.serializer_class(data=request.data)

Answer 1

You need to use ObtainAuthToken.as_view(). Any APIView automatically uses csrf_exempt() (and explicitly checks the CSRF token if you're using SessionAuthentication), but that won't work if you're not using .as_view(). You don't have to explicitly use csrf_exempt on top of what APIView does.
I'm not sure why you're not using the first url, /login/, but if you're having issues with that url, you're going the wrong way fixing them.
On a side note: csrf_exempt sets an attribute on the function. As such, using it on post() has absolutely no effect, since the middleware won't check the attributes on the post() method. You need to use it on the dispatch() method or as csrf_exempt(ObtainAuthToken.as_view()).