CodingBowl

Testing Django APIs can be a pain, especially with CSRF protection. But with a little Postman scripting, you can automate this process and make your life way easier. This guide will walk you through a simple script that grabs the CSRF token and sets it up for your requests. 🚀

---

The Challenge with CSRF Protection

Django's CSRF (Cross-Site Request Forgery) protection is a vital security feature. It ensures that only legitimate requests originating from your application can modify data. This is great for security, but it means you can't just send a POST request to your API endpoint without a valid token. The server will reject the request with a 403 Forbidden error.

When you access a Django-powered site, the server sends a CSRF token in a cookie named csrftoken. For subsequent requests, you need to include this token in the headers to prove you're not a malicious actor. Manually copying and pasting this token for every request is not an option.

---

The Postman Solution: A Simple Script

The key to automating this is to use Postman's scripting capabilities. We can write a script that runs before each request, automatically grabbing the csrftoken from the cookies and setting it as an environment variable.

Step 1: Get the CSRF Token from Cookies

First, you need a script that runs in the Tests tab of a GET request to a page that sets the csrftoken cookie (like your login page or homepage). The script below gets the cookie and sets it to an environment variable.

// Get csrftoken from cookies
let csrfCookie = pm.cookies.get("csrftoken");
if (csrfCookie) {
    pm.environment.set("csrftoken", csrfCookie);
}

This script does a few things:

• pm.cookies.get("csrftoken"): This line gets the value of the cookie named csrftoken.
• pm.environment.set("csrftoken", csrfCookie): If the cookie exists, this line stores its value in a Postman environment variable also named csrftoken.

Step 2: Use the Environment Variable in Headers

Now that the token is stored, you can use it in the headers for all your subsequent POST, PUT, or DELETE requests. You'll need to configure three specific headers:

• X-CSRFToken: This header sends the token to the server. Its value should be the environment variable you just set: {{csrftoken}}.
• Cookie: You also need to send the csrftoken back as a cookie. The value should be csrftoken={{csrftoken}}.
• HX-Request: If your Django API is designed to work with HTMX, you'll also need to include this header. It's often set to true or a similar value to indicate an HTMX-powered request.

Your headers should look like this:

Header	Value
X-CSRFToken	{{csrftoken}}
Cookie	csrftoken={{csrftoken}}
HX-Request	true

Step 3: Add Form Values to the Request Body

For form submissions, you'll need to use the x-www-form-urlencoded body type in Postman. Here's how to add the form data, including the CSRF token, so Django accepts your request.

In the request body, select x-www-form-urlencoded and add your key-value pairs. You must include the CSRF token here as well with the key csrfmiddlewaretoken and the value as your environment variable.

Your body's key-value pairs should look like this:

Key	Value
username	your_username
password	your_password
csrfmiddlewaretoken	{{csrftoken}}

By setting up your collection like this, you can now send authenticated requests without any manual work. Postman will automatically handle the token for you, making your API testing process much smoother. Happy coding! 💻