I have a RESTful API. There are two ways to authenticate to it: a user/password-centric model, and OAuth2.

Although user/password-authenticated users can make requests to this specific API endpoint, they are rejected in the Django view code. Only clients that have authenticated via OAuth2 and have permissions to access this resource may make changes or view data.

Other server software that POSTs to this endpoint - which I don't have any control over - don't support CSRF tokens.

Are there any security risks in exposing end points like this? I figure that there aren't, since a web user cannot do anything more than trigger code that will reject them. Do I need any additional precautions?


  • Can you explain what you mean by the view code is rejecting them? Unless I'm misunderstanding, the code in the view wouldnt reject them because its on the client side and a csrf vulnerability would post directly to the server, or maybe im misunderstanding. – joe Mar 16 '17 at 4:45
  • Sorry, "views" is what Django calls the code that executes when a request is made – std''OrgnlDave Mar 16 '17 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.