CSRF token failing on second post Django Rest Framework - django

Question

I'm having an issue where I can log in successfully but any subsequent requests show as
"detail":"CSRF Failed: CSRF token missing or incorrect."
I have no clue what I'm doing wrong, I've looked over Requests docs, DRF docs, turned off authentication to validate the url and searched old SO posts on the subject.
Here is a basic function with attached basic info
def will_fail():
CURRENT_URL = 'http://127.0.0.1:8000/{}'
session = requests.Session()
response = session.get(CURRENT_URL.format('api-auth/login/'))
csrftoken = response.cookies['csrftoken']
first_response = session.post(CURRENT_URL.format('api-auth/login/'),
data={'username': 'itsme', 'password': 'password'},
headers={'X-CSRFToken': csrftoken})
response = session.post(CURRENT_URL.format('api-v1/languages/'),
params={'name': "French", "audio_base": "adpifajsdpfijsdp"},
headers={'X-CSRFToken': csrftoken})
first_response (login):
URL - 'http://127.0.0.1:8000/api-v1/'
Text - {"languages":"http://127.0.0.1:8000/api-v1/languages/","phrases":"http://127.0.0.1:8000/api-v1/phrases/","stats":"http://127.0.0.1:8000/api-v1/stats/"}
Status - <Response [200]>
response (add language):
URL - 'http://127.0.0.1:8000/api-v1/languages/?audio_base=adpifajsdpfijsdp&name=French'
Text - {"detail":"CSRF Failed: CSRF token missing or incorrect."}
Status - <Response [403]>
The settings are very basic since I'd just started on this:
THIRD_PARTY_APP = [
'rest_framework.authtoken',
'rest_framework',
]
REST_FRAMEWORK = {
'DEFAULT_AUTHENTICATION_CLASSES': (
'rest_framework.authentication.SessionAuthentication',
),
'DEFAULT_PERMISSION_CLASSES': (
'rest_framework.permissions.IsAuthenticated',
)
}
Here is the URL info which is also pretty generic
from training.views import LanguageViewSet, PhraseViewSet, PhraseStatsViewSet
router = DefaultRouter()
router.register(r'languages', LanguageViewSet)
router.register(r'phrases', PhraseViewSet)
router.register(r'stats', PhraseStatsViewSet)
urlpatterns = [
url(r'^admin/', admin.site.urls),
url(r'^api-auth/', include('rest_framework.urls', namespace='rest_framework')),
url(r'^api-v1/', include(router.urls, namespace='api'))
]
I'm using ModelSerializers and ModelViewSets, I didn't override any methods and included all fields.
EDIT:
I had already tried updating the token as well but it gave me a KeyError -
Traceback (most recent call last):
File "C:/Users/Me/PycharmProjects/proj/post_data.py", line 70, in <module>
will_fail()
File "C:/Users/Me/PycharmProjects/proj/post_data.py", line 62, in will_fail
csrftoken = first_response.cookies['csrftoken']
File "C:\Users\Me\Envs\proj\lib\site-packages\requests\cookies.py", line 329, in __getitem__
return self._find_no_duplicates(name)
File "C:\Users\Me\Envs\proj\lib\site-packages\requests\cookies.py", line 400, in _find_no_duplicates
raise KeyError('name=%r, domain=%r, path=%r' % (name, domain, path))
KeyError: "name='csrftoken', domain=None, path=None"

Answer 1

The problem is that your first request logs the user in. Django rotates the token when you log in:
Why might a user encounter a CSRF validation failure after logging in?
For security reasons, CSRF tokens are rotated each time a user logs in. Any page with a form generated before a login will have an old, invalid CSRF token and need to be reloaded. This might happen if a user uses the back button after a login or if they log in in a different browser tab.
The token that you use in the next requests is the token that was used before it was rotated. You need to get the new token from the cookie after the login request.
On top of that, requests transparently follows redirects, and return the last response. Since the second response (probably) doesn't use the token, it isn't set as a cookie. You can use allow_redirects=False to get the first request, and then get the new token from that request. Alternatively you can sent a new GET request for a page that uses the token in the response body, then the token will also be sent as a cookie.
...
first_response = session.post(CURRENT_URL.format('api-auth/login/'),
data={'username': 'itsme', 'password': 'password'},
headers={'X-CSRFToken': csrftoken},
allow_redirects=False)
# Get the new token
newcsrftoken = first_response.cookies['csrftoken']
response = session.post(CURRENT_URL.format('api-v1/languages/'),
params={'name': "French", "audio_base": "adpifajsdpfijsdp"},
headers={'X-CSRFToken': newcsrftoken})

Answer 2

You're likely not using sessions with Requests which would keep the initial response cookies for the next requests.
DRF tells you more about how CSRF works with DRF at http://www.django-rest-framework.org/topics/ajax-csrf-cors/#csrf-protection