django csrf for api that works with ios apps -

i building ios app communicates server getting data.

if normal app, can send csrf token via forms (since same domain). but, ios apps, dont think can set csrf token .

so, when making requests ios apps, server, getting error regarding csrf. so, whats solution this? disabling csrf feature or other better way ? first ios app, please tell me better way follow that.

for urls ("api end points") ios app accessing, need specify @csrf_exempt on corresponding view functions disable csrf protection.

more details here - https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#django.views.decorators.csrf.csrf_exempt

and protect urls via other authentication methods, such session authentication.

for authentication purposes, can take reference django rest framework , django tastypie has done. both use sessionauthentication classes handle authentication , protect exposed urls (api endpoints) ios app can connect to.

references:-

• http://django-rest-framework.org/api-guide/authentication.html
• https://django-tastypie.readthedocs.org/en/latest/authentication_authorization.html

django tastypie has authorization class, not confused authentication. has apikey authorization class becomes useful when want expose django urls other 3rd party developers may want build app of own talk django urls access data (think "facebook apis"). each 3rd party developer can in essence provided unique api , because have apikeyauthorization class , unique api key provided each 3rd party app, can sure "authorized" apps can consume django urls. essence of how various big platforms "google+" or "facebook" etc work.

details of how django's csrf works

https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#how-it-works

the csrf protection based on following things:

a csrf cookie set random value (a session independent nonce, called), other sites not have access to.

this cookie set csrfviewmiddleware. meant permanent, since there no way set cookie never expires, sent every response has called django.middleware.csrf.get_token() (the function used internally retrieve csrf token).

a hidden form field name ‘csrfmiddlewaretoken’ present in outgoing post forms. value of field value of csrf cookie.

this part done template tag.

for incoming requests not using http get, head, options or trace, csrf cookie must present, , ‘csrfmiddlewaretoken’ field must present , correct. if isn’t, user 403 error.

this check done csrfviewmiddleware.

in addition, https requests, strict referer checking done csrfviewmiddleware. necessary address man-in-the-middle attack possible under https when using session independent nonce, due fact http ‘set-cookie’ headers (unfortunately) accepted clients talking site under https. (referer checking not done http requests because presence of referer header not reliable enough under http.)

this ensures forms have originated web site can used post data back.