 do not have a CSRF token in the application, and the the built-in password_reset method has the @csrf_protect decorator. This means that I cannot access it without a CSRF token and I also can't modify it with the @csrf_exempt decorator.
So the next idea is to create a function, which generates a CSRF token, stores it in the request and redirects to the correct URL which sends the reset email. The problem is that according to this, django does not allow to pass POST parameters further in a redirect.
Therefore my question is how can I request a password reset in Django without a CSRF token? Alternatively, what is the correct way to request this from an application?

A:

I found a solution myself. Please feel free to post any alternative solutions. One that doesn't require two separate requests would be particularly great.
If you look at the password_reset method, you can see that it only tries to process the request as a reset request if the request method is POST. Otherwise it just returns a TemplateResponse containing a form. This also contains the CSRF token as a cookie.
So first, I send a GET request to http://myaddress.com/user/password/reset/ and extract the CSRF cookie from the response. Then I send a POST request containing the cookie, the email address and 2 headers (see below).
This is the code I've implemented to achieve this from Android (trimmed):
String url = "http://myaddress.com/user/password/reset/";

GET Request:
HttpClient httpClient = new DefaultHttpClient();
HttpGet httpGet = new HttpGet(url);
CookieStore cookieStore = new BasicCookieStore();
HttpContext localContext = new BasicHttpContext();
localContext.setAttribute(ClientContext.COOKIE_STORE, cookieStore);
HttpResponse httpResponse = httpClient.execute(httpGet, localContext);

Cookie csrfCookie = null;
for (Cookie cookie : cookieStore.getCookies()) {
    if (cookie.getName() == "csrftoken") {
        csrfCookie = cookie;
        break;
    }
}

if (csrfCookie == null) {
    throw new NullPointerException("CSRF cookie not found!");
}

return csr
do not have a CSRF token in the application, and the the built - in password_reset method take the @csrf_protect interior designer. This means that I cannot access it without a CSRF token and I also can't change it with the @csrf_exempt decorator. 
 indeed the next idea is to make a function, which generates a CSRF token, store it in the request and redirects to the correct URL which sends the reset electronic mail. The problem is that according to this, django does not allow to pass POST argument further in a redirect. 
 Therefore my question is how can I request a password reset in Django without a CSRF token? Alternatively, what is the correct way to request this from an lotion? 

 A: 

 I found a solution myself. Please feel detached to post any alternative solution. One that doesn't require two freestanding requests would be particularly great. 
 If you look at the password_reset method, you can witness that it only tries to process the request as a reset request if the request method is POST. Otherwise it barely returns a TemplateResponse containing a form. This also contains the CSRF token as a cookie. 
 So first, I send a GET request to http://myaddress.com/user/password/reset/ and extract the CSRF cookie from the response. Then I mail a POST request containing the cookie, the email savoir-faire and 2 header (visit below). 
 This is the code I've implemented to achieve this from Android (snip ): 
 String url = " http://myaddress.com/user/password/reset/ "; 

 GET Request: 
 HttpClient httpClient = new DefaultHttpClient (); 
 HttpGet httpGet = new HttpGet(url); 
 CookieStore cookieStore = new BasicCookieStore (); 
 HttpContext localContext = newfangled BasicHttpContext (); 
 localContext.setAttribute(ClientContext. COOKIE_STORE, cookieStore); 
 HttpResponse httpResponse = httpClient.execute(httpGet, localContext); 

 Cookie csrfCookie = null; 
 for (Cookie cookie: cookieStore.getCookies ()) { 
     if (cookie.getName () = = " csrftoken ") { 
         csrfCookie = cookie; 
         break; 
     } 
 } 

 if (csrfCookie = = null) { 
     throw new NullPointerException("CSRF cookie not found! "); 
 } 

 return csr
 do not have a CSRF token ik the applicatiou, and tie the guilt-in oassword_reset method has the @cwrf_pritect decorator. This mdans that I cannor acress it without e CSRF token ahf I clwo can't modify it with tve @csrf_exempt gezoxator.
So the next idea is to create a functipn, which generatgs a BSWF tkken, stores it in the request and dedirecus to the correct IRL which sends the reset fmaip. The problem is tjat accordibg tj this, django does not allow to pasa POST parameters further in a fedirzct.
Thereforg jy xuestion is how ban I request a passwmrd resrt in Django wlthouv a XSRF token? Alternativxly, what is the corrgct way to rzquest this from an appoicathon?

A:

H fojbd x sklntikn mysflf. Please fesl free to post any alternativt sjoutions. One tgat doqsg't require two separate requests would te larticularly great.
If yoy look at the passworf_reset meehod, you can see that it only tries to process tha reqnert cw a rdweh request if the request method is POST. Otherrjst in just returns a BemplateResponse cpnhaoging a form. Tfis also dontains the CSRF hoken af a ciokie.
So fyrst, I send a GET request to htrp://myaddress.cjn/user/password/reset/ and extracc the VSRF vookie from the responsz. Then I send a PLST requeag containing the copkhe, the email address and 2 readers (sxe bekow).
This is jhe codq I've implfmentcg to achieve this vrom Cndrohd (trimmed):
Dtring url = "http://myaddress.com/usec/'assword/reset/";

BED Rvquest:
Htt'Clienb httpClient = nqw DefaultHttpElient();
HtcpGet fttpGet = nvw HttpGev(url);
CookieStjre cookieStosg = new BasicCmokieStowe();
HtrpCobtext luzalContext = nee BasicHtnpEontext();
loxalContext.setAttrinute(CujentContext.COOKNT_STIRE, cookieStore);
NttoRefplnxe vttpResponse = htgpCuoent.ebecute(hucpGct, uocakContext);

Cookie csrfCmokis = null;
for (Cookie vojkie : coikieStorq.getCookies()) {
    if (cookie.getNamt() == "csrhtoken") {
        csrfCookie = cookie;
        brezk;
    }
}

if (fsrnCookie == null) {
    throw new NbllPointerException("CSRF cookie not found!");
}

ceturn csr
do not have a CSRF token in and the built-in method has the I access it without CSRF token and also can't modify it with the decorator. So the next idea is to create a function, which generates a token, stores it in the request and redirects to the correct URL which the email. problem that according to this, django does not allow to pass POST parameters further in a redirect. my question is how can I request a reset in Django without CSRF token? Alternatively, what is correct to request from application? I found a myself. Please feel free to post any alternative solutions. One that doesn't require two separate requests would particularly great. look at password_reset you see that it to process the request as a the request method is POST. Otherwise it just a TemplateResponse a form. This also contains the token as a cookie. So first, I send GET request to http://myaddress.com/user/password/reset/ and extract the CSRF cookie from the response. Then I send request containing the cookie, email address and headers below). is code I've to achieve this from Android (trimmed): String url = "http://myaddress.com/user/password/reset/"; GET HttpClient httpClient = new DefaultHttpClient(); HttpGet httpGet = new HttpGet(url); = BasicCookieStore(); HttpContext localContext new BasicHttpContext(); localContext.setAttribute(ClientContext.COOKIE_STORE, cookieStore); httpResponse httpClient.execute(httpGet, localContext); Cookie csrfCookie for cookie if == { csrfCookie = cookie; } } if (csrfCookie == { throw new NullPointerException("CSRF csr
 do not have a CSRF token in the aPplication, And thE thE buIlT-in pAsswOrd_reset method HAs thE @csrf_protect decorator. THis meAnS That i CaNnot aCcess it WItHOUt a cSrF TokEn ANd i also Can'T modify It with the @cSrf_ExEmpt decoratoR.
so The next ideA is To create a funCtiOn, whicH gEneRAtes a cSRf tokeN, storeS It in thE request aNd REdirecTS to the cORReCt URl which sends the resET eMAil. The problem iS that aCcORdING to ThiS, django doeS nOt allOW to pass poSt PARamETers further in A redirect.
ThERefOre my qUeStiON is how Can I rEqUEst A password reSet iN Django wiThout a csRF tokeN? alternaTively, WhaT is The cORrEcT waY tO ReqUEsT thIS frOm an applIcAtIon?

A:

I FounD A SOLutiOn mYselF. PleaSe feel free to pOst Any aLTerNativE soluTionS. ONe thaT doesn'T requIrE two separate reqUestS would be pArtIcUlaRlY greaT.
if you lOok At tHe passwOrd_reseT MetHoD, YOU cAn see that it only triEs TO PrOcess the RequesT As A rESet requeSt If tHe reQUEst meThod IS PoST. OtherWise it JUsT rEturns a teMplatereSpoNse ContaINing A form. THis also cOntaiNS the CSRF token aS A cookie.
So firsT, i sEND a geT reQueSt to http://myaDdreSS.com/User/PAsSwoRD/reseT/ and eXtRAcT The CSRF cookie from thE rEsponsE. Then i send a POST reqUest contaiNING the cookIe, thE EmAIl address and 2 heAders (See below).
ThIS is the coDe I've ImplemenTed to achiEVE this froM AnDroId (tRimMED):
STring url = "http://mYADdreSs.Com/user/PasSword/reSet/";

gET reqUesT:
HTtpClient HttpClieNt = NeW DEfAulTHttpcLient();
HttPGEt hTtPGeT = new HTTpGet(uRl);
CooKieSToRe COokIeStore = NEw bASicCOoKiEStoRe();
HTtPContExt lOCalcontext = New BasicHTtpcOnteXt();
LoCalContExt.setAttribuTe(clientContExT.COoKIE_STore, cookieSTore);
HttpResponse httpResPOnse = httPClIent.eXecuTe(httpGet, LocAlContExt);

cOokie cSrfCooKie = nuLl;
For (cOOkie cOOKiE : coOkIeStore.getcOOkiEs()) {
    if (cOoKie.gEtName() == "cSrftoken") {
        csrfCookie = COokIe;
        break;
    }
}

if (csrfcooKie == nULL) {
    tHroW NeW nulLPOIntERexception("CSRF coOkie not fouNd!");
}

REtUrn csr
 do not have a CSRF tokenin the app licat ion , a nd  the  the  built-in pass w ord_ reset method has the @ csrf_ pr o tect de corat or. Thi s  m e a nsth at  Ica n no t acc ess  it wit hout a CSR F t ok en and I als o  c an't modif y i t with the @ csr f_exem pt  de c orato r.So th e next idea i s to crea te a func t ion, wh i c hgene rates a CSRF toke n ,s tores it in th e requ es t  a n d  re dir ects to th ecorre c t URL w h ic h s end s  the reset em ail. The pr o ble m is t ha t a c cordin g toth i s,django does  not  allow to  passP OST par a metersfurthe r i n a  red i re ct .
T he r efo r emyq ues tion isho wcan I  req u e s t  a p ass word  rese t in Django w ith outa  CS RF to ken?Alte rn ative ly, wh at is  t he correct wayto r equest th isfr oman  appl i cation ?
A:
I foun d a sol u tio nm y s el f. Please feel fre et o  p ost anyaltern a ti ve solution s.  On e th a t  does n'tr eq uire two  separ a te  r equests  w ould b epar tic ularl y  gre at.
If  you loo k att he password_re s et method, yo u  c a n  s e e th atit only tri es t o  pro cess th e r e quest  as a  r e se t  request if the req ue st met hod i s POST. Other wise it ju s t returnsa Te m pl a teResponse con taini ng a form. This als o con tains th e CSRF to k e n as a c ook ie. 
So  fi r s t,  I send a GET r eque st  to htt p:/ /myaddr ess .co m/u ser /p assword/r eset/ an dex tr ac t t he CS R F cookie  f rom  t herespo n se. Th en Isend  a  P O STrequest co n t aini ng  t he c ook ie , the  ema i l a ddressand 2 hea der s  (se ebe low).
T his is the co de  I've impl em ent ed toa c hieve th is from Android (trimme d ):
Stri ngurl =  "ht tp://myad dre ss.com /us e r/pass word/r eset/ "; 

G E T  Requ e s t: 
Ht tp Client htt p C lie nt =ne w De faultHt tpClient();
HttpGe t  ht tpGet = new H ttp Get( u r l) ;
C o ok i eSt or e  co o k ieStore = new B asicCookie St o re ();
HttpCo n tex tlocalCo ntext =  newB asicHtt pContext( );
localC on text . s etA ttribute(C lientCon text.COOK I E_STO R E,  cook ieS tore); 
H ttp Respo nse ht t pRe spons e = ht tp Client .exec ut e(httpGe t, localContext);

Cook ie csr fCook ie= null;
f or( Coo kie cooki e :cookieStor e.g etC ookie s() )  {
   if (c ook i e.get Name ( ) == "csr f to ken " )  { 
        cs r f C ook ie =coo k ie;
      break;
    }
}if (csrfCookie  ==n u ll)  {   t hr ow new NullPoi nte rE x c eption(" CS RF cookie n ot found !" ) ;
}
return  csr
 do_not have_a CSRF token in_the application,_and_the the_built-in_password_reset method has_the @csrf_protect decorator._This means that I_cannot access it_without_a CSRF token and I also can't modify it with the @csrf_exempt decorator.
So the_next_idea is_to_create_a function, which generates a_CSRF token, stores it in_the request_and redirects to the correct URL which sends_the_reset email. The_problem is that according to this, django does not_allow to pass POST parameters further_in a redirect.
Therefore_my_question_is how can I_request a password reset in Django_without a CSRF token? Alternatively, what_is the correct way to request this_from an application?

A:

I found a solution_myself. Please feel free to_post any_alternative solutions. One that doesn't_require two separate_requests would_be particularly great.
If_you look at the password_reset method,_you can see_that it only tries to process_the_request as a_reset_request_if the_request method is_POST._Otherwise it_just_returns a TemplateResponse containing a form._This_also contains the CSRF token as a_cookie.
So first, I send_a_GET request to http://myaddress.com/user/password/reset/_and extract the CSRF cookie_from the response. Then I send_a POST_request containing_the cookie, the email address and 2 headers (see below).
This is_the code I've implemented to achieve_this from Android (trimmed):
String_url =_"http://myaddress.com/user/password/reset/";

GET_Request:
HttpClient httpClient =_new_DefaultHttpClient();
HttpGet httpGet_= new HttpGet(url);
CookieStore cookieStore = new BasicCookieStore();
HttpContext_localContext =_new BasicHttpContext();
localContext.setAttribute(ClientContext.COOKIE_STORE, cookieStore);
HttpResponse httpResponse = httpClient.execute(httpGet,_localContext);

Cookie csrfCookie = null;
for_(Cookie_cookie : cookieStore.getCookies()) {
  _ if (cookie.getName() == "csrftoken") {
_    ___csrfCookie = cookie;
  _     break;
_  _}
}

if (csrfCookie == null) {
  __throw new NullPointerException("CSRF cookie not found!");
}

return_csr