Menu
I'm trying to test my web server's login with Postman. First, I send a GET request to my login url, and I get a CSRF token as a cookie. Then, I make a POST request to that login page, with my username, password, and CSRF token.
My problem is, when I do this in Postman, I get a 403 forbidden error when I try to make that POST request to login. I'm copying the CSRF token received and putting it as one of the POST parameters, and I'm using a valid username and password. Is there anything I'm overlooking here?
502
Jerry suggested using an environment variable in Postman to share CSRF token between 2 (or more) requests. Where the first request is getting CSRF token for you and stores it in an environment variable while subsequent requests consume this CSRF token via the variable. Sounds logical.
After successful login there is no need to supply username and password to the request, you need only the CSRF token since you already authenticated. You need to set it as a header in the request, not in the body. X-CSRFToken is the key and the value is CSRF token from the cookie.
Instead, we can use Postman scripting feature to extract the token from the cookie and set it to an environment variable. In Test section of the postman, add these lines. var xsrfCookie = postman.getResponseCookie ("csrftoken"); postman.setEnvironmentVariable ('csrftoken', xsrfCookie.value);
Do you set a session csrfmiddlewaretoken cookie? After successful login there is no need to supply username and password to the request, you need only the CSRF token since you already authenticated. You need to set it as a header in the request, not in the body. X-CSRFToken is the key and the value is CSRF token from the cookie.
You need to set it as a header in the request, not in the body. X-CSRFToken is the key and the value is CSRF token from the cookie. This will work if you are using an API framework like Tastypie or Django Rest Framework.
If you are authenticating without an API layer you would need to actually attach the cookie or create one with the CSRF token. This post explains it.
82
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
