title: Django API Testing : csrf exempt
body: <p>I'm getting a <code>&quot;Forbidden (CSRF cookie not set.): /user/admin/sign-up&quot;</code> error whenever I test class based views. When I change those views to functional based views with <code>@csrf_exempt</code> on top of the function declaration, it works.</p>
  <p><strong>Postman POST Request:</strong></p>
  <ul>
  <li>localhost:8000/admin/sign-up</li>
  <li>body : <code>{'email' : 'email@gmail.com', 'password' : 123123}</code></li>
  </ul>
  <p><strong>URL path patterns:</strong></p>
  <pre><code>...
  path(‘/admin/sign-up’, views.AdminSignUpView),
  ...
  </code></pre>
  <p><strong>Views.py</strong></p>
  <pre class="lang-py prettyprint-override"><code>@csrf_exempt
  def token_verification(request,**kwargs):
      if request.method == “POST”:
          id = kwargs.get(‘id’)
          token = kwargs.get(‘token’)
          user = User.objects.get(id = id)
          redirect_url = ‘/eval/intro’
          is_valid = user_activation_token.check_token(user,token)
          if is_valid:
              user.is_active = True
              user.save()
              return HttpResponseRedirect(redirect_url,status = 200)
          else:
              return HttpResponse(status = 403)
  
  
  class AdminSignInView(View):
      @csrf_exempt
      def post(self,request):
          data = json.loads(request.body)
          try:
              if User.objects.filter(name = data[‘email’]).exists():
                  user = User.objects.get(name=data[‘email’])
  
                  if bcrypt.checkpw(data[‘password’].encode(‘utf-8’),user.password.encode(‘utf-8’)):
                      token  = jwt.encode({‘email’:data[‘email’]}, SECRET, algorithm = HASH).decode(‘utf-8’)
                      return JsonResponse({ ‘token’ : token }, status = 200)
  
                  return JsonResponse({ ‘message’ : ‘INVALID_USER’ }, status = 401)
              return JsonResponse({ ‘message’ : ‘INVALID_USER’ }, status = 401)
  
          except KeyError:
              return JsonResponse({ ‘message’ : ‘INVALID_KEYS’ }, status = 400)
  
  
  
  class AdminSignUpView(View):
      @csrf_exempt
      def post(self,request):
          try:
              data = json.loads(request.body)
              if not User.objects.filter(email = data[‘email’]).exists:
                  password = bcrypt.hashpw(data[‘password’].encode(‘utf-8’),bcrypt.gensalt())
                  crypted = password.decode(‘utf-8’)
                  User.objects.create(
                      name  = data[‘name’],
                      password = bcrypt,
                      email = data[‘email’],
                      auth_id  = data[‘auth_id’]
                  )
                  return HttpResponse(status = 200)
  
          except KeyError:
                  return JsonResponse({ ‘message’ : ‘INVALID_KEYS’ },status = 4000)
  </code></pre>
  <p><strong>Models.py</strong></p>
  <pre class="lang-py prettyprint-override"><code>class User(models.Model):
      name        = models.CharField(max_length = 50)
      email       = models.EmailField(max_length = 200,unique = True, blank = False)
      department  = models.ForeignKey('Department', on_delete = models.SET_NULL, null = True)
      is_active   = models.BooleanField(default=False)
      question    = models.ManyToManyField('eval.Question',through='UserQuestion')
      auth        = models.ForeignKey('Auth', on_delete = models.SET_NULL, null = True)
  
      class Meta:
          db_table = 'users'
  </code></pre>
  <p><code>token_verification</code> view, which is written in function based, works fine but the last two raised an error. I think the fact that the decorator only goes on top of the function brings up this error, but I'm not sure why <code>@csrf_exempt</code> is necessary for some views.</p>
  <p>I have no clue why I'm getting the <code>csrf</code> issue at this time.</p>