Django AJAX post not working with CSRF - ajax

Question

I have this ajax like vote on my article model:
#csrf_exempt
#login_required
def like(request):
args = {}
if request.method == 'POST':
user = request.POST.get('user')
lu= request.user
post_id = int(request.POST.get('post_id'))
try:
liked_article = Article.objects.get(id = post_id)
except:
liked_article = None
if ArticleLike.objects.filter(liker=lu.id, article=post_id).exists():
liked_article.likes -=1
liked_article.save()
ArticleLike.objects.filter(article=post_id, liker=lu.id).delete()
else:
liked_article.likes +=1
liked_article.save()
newliker = ArticleLike(article=post_id, liker=lu.id)
newliker.save()
args.update(csrf(request))
args['likes'] = str(liked_article.likes)
return render(request, 'ajax_like.html', args)
Here is the ajax snippet:
$(function(){
$('#like').click(function(){
$.ajax({
type: "POST",
url: "/article/like/",
data: {
'post_id': $(this).attr('name'),
'csrfmiddlewaretoken': '{{csrf_token}}'
},
success: likeSuccess,
dataType: 'html'
});
});
});
function likeSuccess(data, textStatus, jqXHR)
{
$('#like_count').html(data);
}
and ajax_lik.html
<p id="like_count">
{% if likes > 0 %}
{{likes}}
</p>
{% else %}
wow
</i>
{% endif %}
The view works perfectly well with #csrf_exempt decorator active, but with csrf, I get 403 Forbidden error.
I tried different tweaks but could not figure out how solve this, so I appreciate your help.

Answer 1

If you are using a #csrfexempt decorator then you don't need to send a csrf_token. BTW, csrf_token shouldn't be part of the POST data,
data: {
'post_id': $(this).attr('name'),
'csrfmiddlewaretoken': '{{csrf_token}}'
}
it should be in the request's header "X-CSRFToken".
Here a little example to set custom headers to an ajax request using jquery (docs here):
$.ajax({
url: "/article/like/",
data: { post_id: $(this).attr('name') },
type: "POST",
beforeSend: function(xhr){xhr.setRequestHeader('X-CSRFToken', "{{csrf_token}}");},
success: likeSuccess,
dataType: 'html'
});
You can see Django's docs for this here