curl request on django working without csrf token - django

Question

I have a django project running on Heroku, using Django REST framework
I use the following middlewares:
MIDDLEWARE = [
'django.middleware.security.SecurityMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.common.CommonMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
'django.middleware.clickjacking.XFrameOptionsMiddleware',
]
Here is one of my class-based views :
class CommunityMemberView(APIView):
permissions_classes = [IsAuthenticated, ]
serializer_class = CommunitySerializer
def post(self, request, community_id=None):
"""
add the member identified by 'id'
to the community 'community_id', if it exists.
"""
data = request.data
id = data.get('id')
account = Account.objects.get(id=id)
community = Community.objects.get(id=community_id)
community.add_member(account)
serializer = self.serializer_class(community, context={'request': request})
return Response(serializer.data, status=status.HTTP_201_CREATED)
When I try to do a POST request using curl, and without any csrf token, it works fine, and I don't know why. I don't use any decorator, but if I understand the django doc correctly, I don't need to.
curl -v -H "content:application/json" -X POST -H "Content-Type:application/json" -d '{"id":"3"}' https://www.example.com/api/v1/community/2/member/ | python -m json.tool
I'm guessing there is an obvious reason, but I can't find it in the django doc nor on Stack Overflow, all the previous questions on a related topic were about why it's not working, not the contrary.
Thanks

Answer 1

Im assuming you are using django-rest-framework?
DRF views are wrapped w/ #csrf_excempt decorator unless you're using SessionAuthentication
See http://www.django-rest-framework.org/topics/ajax-csrf-cors/