Django CSRF Token Missing For iOS Post Request

Question

Currently, I'm making an application that uses Django Rest Framework as my API and iOS (Swift) as my frontend using Alamofire for API calls. However, I've run into an issue with user authentication - whenever I try to make a POST request to login a user using Alamofire, I'm hit with this 403 error:

Here is my login setup with Alamofire:

func loginUser(data: Parameters) {
    let finalUrl = self.generateUrl(addition: "auth/login/")
    print(finalUrl)
    let header: HTTPHeaders = [ "Accept": "application/json", "Content-Type" :"application/json"]

    Alamofire.request(finalUrl,method: .post, parameters: data, encoding: JSONEncoding.default, headers: header).responseString { (response:DataResponse<String>) in
        print(data)
        switch(response.result) {
        case .success(_):
            if response.result.value != nil {
                print(response.result.value!)
            }
            break

        case .failure(_):
            print(response.result.error!)
            break

        }
    }

}

On the API side, the login I am using is the one provided by rest_framework.urls...

url(r'^auth/', include('rest_framework.urls', namespace='rest_framework'))

While advice from similar posts has not resolved my issue, I believe my options are

a.) Exempt my views from requiring a CSRF token (I'm not sure if it's even possible in my case - my views are bundled with include() as part of the rest_framework.urls scheme so decorating with csrf_exempt cannot work)

b.)Obtain a CSRF Token for my POST requests somehow

While these are my ideas, I've yet to find an actual solution or method to implement them, so any help would be greatly appreciated!

Issue a get request in login capture csrf token then use it in POST request. — Rajan Chauhan, Jul 14 '17 at 05:46
If you are using using Class based Views then make sure you add the _ViewName.as_view()_ in urls.py. It worked for me ! — Mirza715, Jul 14 '17 at 07:21

Aniket Pawar · Answer 1 · 2017-07-14T05:55:55.513

Session Based Authentication is not required if you are building APIs for any mobile app. If you don't use cookies to manage your sessions, you don't need any CSRF protection. Am i wrong ? but anyway if you want to do so, pass @csrf_exempt

Instead of that it is better to use Token Based Authentication .You can check it here in the django -rest-api-docs . Token authentication is appropriate for client-server setups, such as native desktop and mobile clients.

Django CSRF Token Missing For iOS Post Request

1 Answers1