[Django]-Django-rest-framework returning 403 response on POST, PUT, DELETE despite AllowAny permissions

Just for anyone that might find the same problem.
If you are using viewsets without routers like:

user_list = UserViewSet.as_view({'get': 'list'})
user_detail = UserViewSet.as_view({'get': 'retrieve'})

Django Rest framework will return 403 unless you define permission_classes at a class level:

class UserViewSet(viewsets.ModelViewSet):
    """
    A viewset for viewing and editing user instances.
    """
    permission_classes= YourPermisionClass

Hope it helps!

For completeness sake, there is one more circumstance under which DRF returns code 403: if you forget to add as_view() to the view declaration in your urls.py file. Just happened to me, and I spent hours until I found where the issue was, so maybe this addition can save some time for someone.

For those that aren’t able to even access their csrftoken from Javascript:

In my case I wasn’t able to get the csrftoken from my Javascript code to be able to set it in my ajax POST. It always printed null. I finally discovered that the django CSRF_COOKIE_HTTPONLY environment variable was set to True.

From the Django Documentation

CSRF_COOKIE_HTTPONLY: If this is set to True, client-side JavaScript will not be able to access the CSRF cookie."

Changing CSRF_COOKIE_HTTPONLY to False allowed me to finally get the csrftoken.

https://docs.djangoproject.com/en/4.1/ref/settings/#std-setting-CSRF_COOKIE_HTTPONLY

If anyone facing similar kind of issue after migrating from Django 3 to Django 4 then it might be because of misconfigured CSRF_TRUSTED_ORIGINS in settings file.

One possible cause will be:

In Django 3, the list of CSRF_TRUSTED_ORIGINS contains only domains without protocol.

CSRF_TRUSTED_ORIGINS = ['example.com']

But in Django 4, the list of CSRF_TRUSTED_ORIGINS should have protocol defined.

CSRF_TRUSTED_ORIGINS = ['https://example.com']

Ref: https://docs.djangoproject.com/en/4.2/ref/settings/#csrf-trusted-origins

One more situation that someone may find is that you get a 403 error on an AllowAny route when you pass an token as null in the "Authorization" header in your request. For example, you may want to allow anyone to use the route but also want to know if the person that used the route is an authenticated user.

E.g.

if (token) {
    headers = {
        "Content-Type": "application/json",
        "Authorization": "Token " + token
    }
} else {
    headers = {
        "Content-Type": "application/json"
    }
}

use @csrf_exempt at the top of your POST function
from django.views.decorators.csrf import csrf_exempt

example

from django.views.decorators.csrf import csrf_exempt
@csrf_exempt
def student_api(request):
    request. MethodMethod == 'POST':
       json_data = request. Body
       stream = io.BytesIO(json_data)
       pythondata = JSONParser().parse(stream)
       serializer = StudentSerializer(data=pythondata)
       if serializer.is_valid():
           serializer.save()
           res = {'msg': 'Data Created'}
           json_data = JSONRenderer().render(res)
           return HttpResponse(json_data, content_type='application/json')
       json_data = JSONRenderer().render(serializer.errors)
       return HttpResponse(json_data, content_type='application/json')