How to disable Django's CSRF validation?

Question

I have commented out csrf processor and middleware lines in settings.py:

122  123 TEMPLATE_CONTEXT_PROCESSORS = ( 124     'django.contrib.auth.context_processors.auth', 125 #    'django.core.context_processors.csrf', 126     'django.core.context_processors.request', 127     'django.core.context_processors.static', 128     'cyathea.processors.static', 129 ) 130  131 MIDDLEWARE_CLASSES = ( 132     'django.middleware.common.CommonMiddleware', 133     'django.contrib.sessions.middleware.SessionMiddleware', 134 #    'django.middleware.csrf.CsrfViewMiddleware', 135     'django.contrib.auth.middleware.AuthenticationMiddleware', 136     'django.contrib.messages.middleware.MessageMiddleware', 137     'django.middleware.locale.LocaleMiddleware', 138     # Uncomment the next line for simple clickjacking protection: 139     # 'django.middleware.clickjacking.XFrameOptionsMiddleware', 140 ) 

But when I use Ajax to send a request, Django still respond 'csrf token is incorrect or missing', and after adding X-CSRFToken to headers, the request would succeed.

What is going on here ?

Answer 1

If you just need some views not to use CSRF, you can use @csrf_exempt:

from django.views.decorators.csrf import csrf_exempt  @csrf_exempt def my_view(request):     return HttpResponse('Hello world') 

You can find more examples and other scenarios in the Django documentation:

• https://docs.djangoproject.com/en/dev/ref/csrf/#edge-cases

Answer 2

To disable CSRF for class-based views, the following worked for me.

I'm using Django 1.10 and Python 3.5.2

from django.utils.decorators import method_decorator from django.views.decorators.csrf import csrf_exempt  @method_decorator(csrf_exempt, name='dispatch') class TestView(View):     def post(self, request, *args, **kwargs):         return HttpResponse('Hello world')