This question came across my mind when I sent an ajax request from html to a backend django server and forgot to add a csrf token to the request payload and recieved this error. Image of Error

403 error means that the request was unauthorized.

I know that while using django, using csrf token is neccessary. But lets take an example where I am using jwt tokens for user authentication and csrf token for request authorization. What will happen first? Authentication or authorization?

The simple answer I found while surfing the web was the Authentication ALWAYS occurs before Authorization. But this statement seems contrary to the error I recieved where the request was unauthorized even before the authentication process started. So what is happening here?

Extending my initial question, if I securely use JWT tokens, is using csrf token for protection against csrf attacks really neccessary (talking in general, not specific to django)? Won't JWT serve the purpose for both? What is the industry standard in such a use case?

  • 403 - Unauthorized means that either the server cannot identify you properly (authentication) or it could but you have no authorization to use the resource.
    – ThoriumBR
    Jul 14, 2023 at 18:06
  • Authorization of request is different from authorization of the caller.
    – defalt
    Jul 14, 2023 at 18:28
  • @ThoriumBR yes, thats because i didnt pass the csrf token. Jul 16, 2023 at 20:11
  • @defalt so which one is it? I didn't pass the csrf token, so probably should be authorization of request? Jul 16, 2023 at 20:11
  • It's authorization of request.
    – defalt
    Jul 16, 2023 at 20:57

1 Answer 1


If the CSRF token is bound to a security session, the server must first establish the session before it can validate the CSRF token. And the session is established only after successful authentication, the authentication must come before the CSRF token validation (authorization).

Regarding your last question, CSRF protection is only necessary for requests made by a client (for example, a browser) that silently adds credentials for the current user, by sending a session cookie, a JWT in a cookie, resending username and password that were previously typed in ("Basic Authentication") or by including a client certificate. If the request is authenticated via a JWT that is transported in an Authorization: Bearer <JWT> header, none of the above applies, therefore a CSRF token does not give additional protection.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .