PYTHON

csrf token exempt django

from django.views.decorators.csrf import csrf_exempt

@csrf_exempt
def xyx(request):
  #your code
  
#this makes the function accept post request without csrf token
#use it just for quick check or for operations where csrftoken authentication
#isn't required

get csrf_token value in django template

# get csrf token value in template
{{ csrf_token }}
# render a input form element 
{% csrf_token %}

csrf token fetch django

let data = {
    'file': file,
    'fileName': file.name,
};
// You have to download 3rd Cookies library
// https://docs.djangoproject.com/en/dev/ref/csrf/#ajax
let csrftoken = Cookies.get('csrftoken');
let response = fetch("/upload/", {
    method: 'POST',
    body: JSON.stringify(data),
    headers: { "X-CSRFToken": csrftoken },
})

csrf token django

Cross Site Request Forgery protection¶
The CSRF middleware and template tag provides easy-to-use protection against
Cross Site Request Forgeries. This type of attack occurs when a malicious
website contains a link, a form button or some JavaScript that is intended 
to perform some action on your website, using the credentials of a logged-in 
user who visits the malicious site in their browser. A related type of attack,
‘login CSRF’, where an attacking site tricks a user’s browser into logging into
a site with someone else’s credentials, is also covered.

The first defense against CSRF attacks is to ensure that GET requests
(and other ‘safe’ methods, as defined by RFC 7231#section-4.2.1) are
 side effect free. Requests via ‘unsafe’ methods, such as POST, PUT,
 and DELETE, can then be protected by following the steps below.