From fc9be55d436dbdd4a667d331348cfb5f421c4c91 Mon Sep 17 00:00:00 2001 From: Piper Merriam Date: Fri, 25 Jul 2014 12:09:07 -0600 Subject: [PATCH] Alter CSRF exemption implementation The previous implementation of decorating `APIView.dispach` with the `csrf_exempt` decorator allowed for an easy-to-make mistake where someone could override the `dispatch` method on a view and inadvertantly remove the csrf exemption of their api view. By moving the decoration of the view into the `as_view` logic, it becomes much more difficult to make this mistake. --- rest_framework/views.py | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/rest_framework/views.py b/rest_framework/views.py index 23df3443f..38346ab79 100644 --- a/rest_framework/views.py +++ b/rest_framework/views.py @@ -103,7 +103,9 @@ class APIView(View): """ view = super(APIView, cls).as_view(**initkwargs) view.cls = cls - return view + # Note: session based authentication is explicitly CSRF validated, + # all other authentication is CSRF exempt. + return csrf_exempt(view) @property def allowed_methods(self): @@ -371,9 +373,9 @@ class APIView(View): response.exception = True return response - # Note: session based authentication is explicitly CSRF validated, - # all other authentication is CSRF exempt. - @csrf_exempt + # Note: Views are made CSRF exempt from within `as_view` as to prevent + # accidental removal of this exemption in cases where `dispatch` needs to + # be overridden. def dispatch(self, request, *args, **kwargs): """ `.dispatch()` is pretty much the same as Django's regular dispatch,