We need csrf_exempt support.
sameerjagtap opened this issue · comments
We need csrf_exempt support like django has. I have a login API (POST) in which i am creating csrf token, but its asking for csrf token even before creating.
https://docs.djangoproject.com/en/3.0/ref/csrf/
Is this for an API or website?
Login API
So do you want to protect the Login POST request with a CSRF token or is it other endpoints that you want protected?
(Side note - what exactly are you trying to protect against? Is this an API consumed by an SPA or is it used by an iOS app for example)
Suppose I don't want to protect Login API (POST). How can i do that? adding [.POST] to ignoredMethods will not work, because it will br applied to all POST API's. Currently there is no provision to exempt particular API from CSRF checks.
The simple way is to just not add the middleware to that route.
As an aside, if you're not using a browser to interact with your API, CSRF really doesn't make any sense, or provide any protection
How can i do that in Vapor 3?
Well if you're adding the middleware globally, change that to add it to a route group and add the routes to that instead. This would be better asked in Vapor Discord
ok, thanks. I will try this.