[Django]-How to make a POST simple JSON using Django REST Framework? CSRF token missing or incorrect

CSRF is exempted by default in Django REST Framework. Therefore, curl POST request works fine. POSTMAN request call returned CSRF incorrect because POSTMAN included csrf token if it is found in Cookies. You can solve this by cleaning up Cookies.

It’s from your REST Framework settings. in your settings.py file, your REST_FRAMEWORK should have the following.

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework.authentication.TokenAuthentication',
    ),
   'DEFAULT_PERMISSION_CLASSES': (
        'rest_framework.permissions.AllowAny',
    ),
}

This will set your REST Framework to use token authentication instead of csrf authentication. And by setting the permission to AllowAny, you can authenticate only where you want to.

OK, well now of course I take back what I said. CSRF does work as intended.

I was making a POST request using a chrome plugin called POSTMAN.
My POST request fails with CSRF enabled.

But a curl POST request using

curl -X POST -H "Content-Type: application/json" -d '
{
    "name": "Manager",
    "description": "someone who manages"
}' http://127.0.0.1:8000/lakeshoreProperties/roles/

works fine…
I had to take off the braces, i.e., [], and make sure there is a slash after the ‘s’ in roles, i.e., roles/, and csrf enabled did not throw any errors.

I’m not sure what the difference between calling using POSTMAN is vs using curl, but POSTMAN is run in the web browser which is the biggest difference. That said, I disabled csrf for the entire class RoleList but one identical request works with Curl, but fails with POSTMAN.

To give an update on current status, and sum up a few answers:

AJAX requests that are made within the same context as the API they are interacting with will typically use SessionAuthentication. This ensures that once a user has logged in, any AJAX requests made can be authenticated using the same session-based authentication that is used for the rest of the website.

AJAX requests that are made on a different site from the API they are communicating with will typically need to use a non-session-based authentication scheme, such as TokenAuthentication.

Therefore, answers recommending to replace SessionAuthentication with TokenAuthentication may solve the issue, but are not necessarily totally correct.

To guard against these type of attacks, you need to do two things:

1. Ensure that the ‘safe’ HTTP operations, such as GET, HEAD and OPTIONS cannot be used to alter any server-side state.

2. Ensure that any ‘unsafe’ HTTP operations, such as POST, PUT, PATCH and DELETE, always require a valid CSRF token.
   If you’re using SessionAuthentication you’ll need to include valid CSRF tokens for any POST, PUT, PATCH or DELETE operations.

In order to make AJAX requests, you need to include CSRF token in the HTTP header, as described in the Django documentation.

Therefore, it is important that csrf is included in header, as for instance this answer suggests.

Reference: Working with AJAX, CSRF & CORS, Django REST framework documentation.

As you said your URL was

http://localhost:8000/lakesShoreProperties/roles

Postman has some issues with localhost.
Sending the POST to 127.0.0.1:8000/your-api/endpoint instead did the trick for me.

the old Postman is having a problem with csrf tokens because it does not working with cookies.

I suggest for you to switch to the new version of postman, it works with cookies and you will not face this problem again.

if you have set AllowAny permission and you facing with csrf issue

REST_FRAMEWORK = {
    'DEFAULT_PERMISSION_CLASSES': [
        'rest_framework.permissions.AllowAny'
    ]
}

then placing following in the settings.py will resolve the issue

REST_SESSION_LOGIN = False