CODEWITHSUNDEEP
djangopostgetcsrfpostman
WhoopsBing
WhoopsBing

Reputation: 533

Sending CSRF Tokens via Postman

I'm trying to test my web server's login with Postman. First, I send a GET request to my login url, and I get a CSRF token as a cookie. Then, I make a POST request to that login page, with my username, password, and CSRF token.

My problem is, when I do this in Postman, I get a 403 forbidden error when I try to make that POST request to login. I'm copying the CSRF token received and putting it as one of the POST parameters, and I'm using a valid username and password. Is there anything I'm overlooking here?

Upvotes: 12

Views: 32065

Answers (3)

Add411
Add411

Reputation: 5

Works for me :

Set in Postman Header :

KEY : Authorization

Value : Token "Your token"

Upvotes: -3

Sumuka
Sumuka

Reputation: 1

Try installing the Postman Interceptor Extension on GoogleChrome. It worked for me.

Upvotes: 0

Pratik Mandrekar
Pratik Mandrekar

Reputation: 9568

You need to set it as a header in the request, not in the body. X-CSRFToken is the key and the value is CSRF token from the cookie. This will work if you are using an API framework like Tastypie or Django Rest Framework.

If you are authenticating without an API layer you would need to actually attach the cookie or create one with the CSRF token. This post explains it.

Upvotes: 18

Related Questions