Sasha Matijasic
Results
2
issues of
Sasha Matijasic
For any custom endpoints that are not HTTP GET, csrf exemption is needed or the call will fail with HTTP 403. One might argue that this fix smells like someone...
`DjangoResource` `as_list` and `as_detail` call `csrf_exempt` on their `super`, but `as_view` is not overriden any custom endpoint method is protected with Django CSRF (and it shouldn't be).