CSRF_FAILURE_VIEW with Django rest framework does not work

708 views Asked by At

Using the TokenAuthentication from DRF to authenticate the web frontend. We have a situation where some times the CSRF cookie becomes invalid due to using different URLs to access the same website. Of cause the user needs to clear the cookies before they can log in again (all expected behaviour).

Would like to delete the cookies with Django by setting the CSRF_FAILURE_VIEW value within the django setting and have a custom view that calls request.session.delete()

But...

DRF overrides the function _reject for the Django class CsrfViewMiddleware which means the setting CSRF_FAILURE_VIEW is never accessed.

class CSRFCheck(CsrfViewMiddleware):
    def _reject(self, request, reason):
        # Return the failure reason instead of an HttpResponse
        return reason

Any ideas as to how this can be addressed?

0

There are 0 answers