How to disable csrf in modelviewset django-rest-framework?

Question

How to disable csrf in modelviewset django-rest-framework?

I will use viewsets.ModelViewSet ( http://django-rest-framework.org/api-guide/viewsets.html#modelviewset ) django-rest-framework.

And my application is api server. Therefore, I do not need to use csrf.

But I do not know how to disable csrf.

Please give me an example!

Answer 1

CSRF applies only if you use SessionAuthentication. If you use one of the other forms of authentication (e.g. TokenAuthentication), it is not required.

Answer 2

You need to wrap the dispatch method of ModelViewSet with csrf_exempt :

from django.utils.decorators import method_decorator from django.views.decorators.csrf import csrf_exempt class MyModelViewSet(viewsets.ModelViewSet): @method_decorator(csrf_exempt) def dispatch(self, *args, **kwargs): return super(MyModelViewSet, self).dispatch(*args, **kwargs) 

or you can achieve the same effect by wrapping the view in urls.py :

 url(r'^snippets/$', csrf_exempt(snippet_list), name='snippet-list'), url(r'^snippets/(?P<pk>[0-9]+)/$', csrf_exempt(snippet_detail), name='snippet-detail'), 

Answer 3

Also make sure api-auth is not included in your urls.