title: csrf_exempt set but CSRF Failed: Referer checking failed - no Referer
body: <p>I have a backend API, it's in django and deployed on Google Endpoint.
  I have a post request that insert data to my DB.</p>
  <p>I created a script to use this endpoint but I got this error:</p>
  <blockquote>
  <p>{&quot;detail&quot;:&quot;CSRF Failed: Referer checking failed - no Referer.&quot;}</p>
  </blockquote>
  <p>Regarding over posts I added the crsf_exempt decorator to my class but it did not change.<br />
  I try to add the decorator two ways:</p>
  <pre><code>class AddUser(APIView):
      &quot;&quot;&quot; Create user and company from csv &quot;&quot;&quot;
  
      @method_decorator(csrf_exempt)
      def post(self, request):
  
  
  @method_decorator(csrf_exempt, name='dispatch')
  class AddUser(APIView):
      &quot;&quot;&quot; Create user and company from csv &quot;&quot;&quot;
  
      def post(self, request):
  </code></pre>
  <p>But both failed.</p>
  <p>This is how I contact my endpoint:</p>
  <pre><code>resp = requests.request(
      method, url,
      headers={'Authorization': 'Bearer {}'.format(
          open_id_connect_token)}, **kwargs)
  </code></pre>
  <p>Any ideas ?
  Thanks</p>
  <hr />
  <p><strong>EDIT</strong></p>
  <p>So I tried to add authentication classes to my views but it appears to be a bad idea. This is being real trouble for me.</p>
  <p>I tried to get the csrftoken doing like this:</p>
  <pre><code>        client = requests.session()
          # Retrieve the CSRF token first
          client.get(url)  # sets cookie
          print(client.cookies)
          if 'csrftoken' in client.cookies:
              # Django 1.6 and up
              csrftoken = client.cookies['csrftoken']
          else:
              # older versions
              csrftoken = client.cookies
  </code></pre>
  <p>Thing is, I am using IAP to protect my API and I do not have any csrftoken cookie but I do have a  something looking like this:</p>
  <blockquote>
  <p>&lt;RequestsCookieJar[&lt;Cookie GCP_IAP_XSRF_NONCE_Q0sNuY-M83380ypJogZscg=1
  for ...</p>
  </blockquote>
  <p>How can I use this to make post request to my API ?</p>