[Fixed]-Security using Django 1.10 + AJAX without any HTML form

1👍

✅

The default method of the ajax function is a GET one, not a POST. So, doing a:

$.ajax({
    url: '/account/switches/',
    data: {'toggle': 'status'}
});

implies that an ajax GET is made. So, you’re not doing a POST request.

If you want a POST request, do it like this:

$.ajax({
    method: 'POST',
    url: '/account/switches/',
    data: {'toggle': 'status'}
});

Of course you have to include the CSRF token then, since it will fail if you try to POST without including one. Look here how to acomplish that.