Django csrf token

[smmoosavi]

How to I get django csrf token? Is there any way CRA proxy html pages from backend server like django. (I know already proxy works for api call)

[smmoosavi]

or proxy every things except /static/*.

[gaearon]

No, there is no built-in proxying for HTML pages.

You can, however, embed anything (e.g. a token) in your HTML page when you serve it.
Does an approach like this help?

[gaearon]

I'm going to close since I provided a workaround—we don't directly integrate with Django so I don't think there is a better answer. Just treat CRA output as a static HTML/JS bundle (which it is), and think how you'd solve this problem with HTML and JS.

[smmoosavi]

Where I can specify __SERVER_DATA__ to use in CRA dev-server?

[gaearon]

Oh, I thought you were referring to production.

Since CRA lets you create single-page apps, you should refer to documentation about CSRF in single-page apps.

Here is what I found about this topic: http://security.stackexchange.com/questions/36468/csrf-protection-and-single-page-apps.

Does it help?

[smmoosavi]

I solve my problem:
solution 1: run my own proxy. you can see gist here

solution 2: open django served page directly and load css and js from CRA

<!-- localhost:8000 -->
<script src="http://localhost:3000"></script>

but in solution 2 hot reload not working. can I set hot reload url from /sock-js/... to http://localhost:3000/sock-js/...?

[gaearon]

No, this is not possible without ejecting (it's just too hard to support so many possible configurations and ensure neither of them breaks with time).

[shangsunset]

Hi, If I were to eject, what should be the best approach that doesnt use jQuery on dev server? I searched around but didnt find any intuitive solution that goes with CRA. Or how should I make Django to server index.html for development?

[gaearon]

I'm not sure what this has to do with jquery.

CRA just produces a static HTML/JS/CSS bundle. It doesn't do anything special. You can serve it with Django exactly the same way you would serve any HTML page with it. Please refer to Django documentation or support groups for this.

[smmoosavi]

I will create full example in few days.

[shangsunset]

@gaearon Thanks for your reply. The problem is that if I make Django render index.html and call bundled js file like this <script src="http://localhost:3000/static/js/bundle.js"></script> the browser wont auto refresh as @smmoosavi mentioned. Is there a way to make auto refresh work in this scenario?

@smmoosavi looking forward to your example.