"CSRF token missing" with PUT/DELETE meethod rest-framework
<p>I'm using using django rest framework browsable api with ModelViewSet to do CRUD actions and want to use permissions.IsAuthenticatedOrReadOnly, but when I'm logged and try to DELETE or PUT I get
<code>"detail": "CSRF Failed: CSRF token missing or incorrect."</code></p>

<p>My view looks like this</p>

<pre><code>class objViewSet(viewsets.ModelViewSet):
    queryset = obj.objects.all()
    serializer_class = objSerializer
    permission_classes = (permissions.IsAuthenticatedOrReadOnly,)
</code></pre>

<p>Settings.py</p>

<pre><code>REST_FRAMEWORK = {
'DEFAULT_PERMISSION_CLASSES': (
    'rest_framework.permissions.AllowAny',
),
</code></pre>

<p>Serializer is just</p>

<pre><code>class ObjSerializer(serializers.ModelSerializer):
    class Meta:
        model = Obj
</code></pre>

<p>Although when I delete permission_classes (so the default allowAny triggers) I can it works just fine.</p>

<p><strong>What I want</strong></p>

<p>To be able to PUT/DELETE only when I'm authenticated. I don't know how to send CSRF token, when all happens automatically (modalviewset does the whole work)</p>

<p>In your REST_FRAMEWORK settings you haven't mentioned the Authentication scheme so DRF uses the default authentication scheme which is SessionAuthentication. This scheme makes it mandatory for you to put csrf token with your requests. You can overcome this by:</p>

<ol>
<li>To make this setting for the whole project in settings.py add</li>
</ol>

<pre><code>

    REST_FRAMEWORK = {
        'DEFAULT_AUTHENTICATION_CLASSES': (
             'rest_framework.authentication.BasicAuthentication',
        )}

</code></pre>

<ol start="2">
<li>To make this setting in specific view do the following in your view</li>
</ol>

<pre><code>

    class objViewSet(viewsets.ModelViewSet):
        queryset = obj.objects.all()
        serializer_class = objSerializer
        permission_classes = (permissions.IsAuthenticatedOrReadOnly,)
        authentication_classes = (BasicAuthentication,)

</code></pre>

<p>source: <a href="http://www.django-rest-framework.org/api-guide/authentication/#sessionauthentication" rel="nofollow">http://www.django-rest-framework.org/api-guide/authentication/#sessionauthentication</a></p>

<p>BTW, csrf token is saved as a cookie called 'csrftoken'. You can retrieve it from HTTP Response and attach it to your request header with the key 'X-CSRFToken'. You can see some details of this on: <a href="https://docs.djangoproject.com/en/dev/ref/csrf/#ajax" rel="nofollow">https://docs.djangoproject.com/en/dev/ref/csrf/#ajax</a></p>

python django rest