From 306c8fb3978256c6b113a7aead88836b0b50b8c2 Mon Sep 17 00:00:00 2001 From: Sasha Matijasic Date: Sun, 6 Jul 2014 19:24:09 +0200 Subject: [PATCH] Call csrf_exempt on DjangoResource.as_view. For any custom endpoints that are not HTTP GET, csrf exemption is needed or the call will fail with HTTP 403. --- restless/dj.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/restless/dj.py b/restless/dj.py index 3ffb778..f361b7a 100644 --- a/restless/dj.py +++ b/restless/dj.py @@ -26,6 +26,10 @@ def as_list(self, *args, **kwargs): def as_detail(self, *args, **kwargs): return csrf_exempt(super(DjangoResource, self).as_detail(*args, **kwargs)) + @classmethod + def as_view(cls, view_type, *args, **kwargs): + return csrf_exempt(super(DjangoResource, cls).as_view(view_type, *args, **kwargs)) + def is_debug(self): # By default, Django-esque. return settings.DEBUG