What are some examples where programmers might want to use csrf_exempt?

Question

By default, Django offers protection against Cross-Site Request Forgery (CSRF) attacks by sending a CSRF token to webpages it generates, which is then sent back with requests to validate them. This is detailed here.

Django provides the csrf_exempt decorator to disable this behaviour. What are some good reasons programmers might want to use it?

This details why it could be dangerous, I'm interested in how it could be useful.

I'm looking for answers that are not obvious (e.g. not knowing how to use the CSRF protection or disabling it temporarily).

Answer 1

For instance, we use it for an interface where another party posts data programmatically. Thus, they can never get a csrf token. The page is, however, basic-auth secured.