starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

GraphQL API CSRF Error #5345

New Issue
Closed
opened 2025-12-29 19:26:55 +01:00 by adam · 2 comments
adam commented 2025-12-29 19:26:55 +01:00
Owner
Copy Link

Originally created by @arjenvri on GitHub (Sep 9, 2021).

Originally assigned to: @jeremystretch on GitHub.

NetBox version

v3.0.1

Python version

3.7

Steps to Reproduce

  1. Use Curl to query the GraphQL API.
    curl -H "Authorization: Token $TOKEN" -H "Content-Type: application/json" -H "Accept: application/json" http://localhost/graphql/ --data '{"query": "query { site_list(status: "active") { name } }"}'

  2. Use curl as suggested in the documentation https://netbox.readthedocs.io/en/stable/graphql-api/overview/#queries
    curl -H "Authorization: Token $TOKEN" -H "Content-Type: application/json" -H "Accept: application/json" http://localhost/graphql/ --data '{"query": "query {circuits(status:\"active\" {cid provider {name}}}"}'

Expected Behavior

GraphQL json data is being returned. Already tried to set the ALLOWED_HOST to * but same result.
See also the discussion here https://github.com/netbox-community/netbox/discussions/7182

Observed Behavior

CSRF Error is raised

Host: localhost:8001
User-Agent: curl/7.68.0
Authorization: Token <snip>
Content-Type: application/json
Accept: application/json
Content-Length: 69

{"query": "query {circuits(status:\"active\" {cid provider {name}}}"}

<<< HTTP/1.1 403 Forbidden
Server: gunicorn
Date: Sun, 05 Sep 2021 08:29:58 GMT
Connection: keep-alive
Content-Type: text/html
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
Content-Length: 1382
Vary: Origin

<!DOCTYPE html>
<html lang="en">
<head> ... various stuff CSS ... </head>
<body>
<div id="summary">
  <h1>Forbidden <span>(403)</span></h1>
  <p>CSRF verification failed. Request aborted.</p>


  <p>You are seeing this message because this site requires a CSRF cookie when submitting forms. This cookie is required for security reasons, to ensure that your browser is not being hijacked by third parties.</p>
  <p>If you have configured your browser to disable cookies, please re-enable them, at least for this site, or for ...same-origin... requests.</p>

</div>

<div id="explanation">
  <p><small>More information is available with DEBUG=True.</small></p>
</div>

</body>
</html>```
Originally created by @arjenvri on GitHub (Sep 9, 2021). Originally assigned to: @jeremystretch on GitHub. ### NetBox version v3.0.1 ### Python version 3.7 ### Steps to Reproduce 1. Use Curl to query the GraphQL API. `curl -H "Authorization: Token $TOKEN" -H "Content-Type: application/json" -H "Accept: application/json" http://localhost/graphql/ --data '{"query": "query { site_list(status: "active") { name } }"}'` 2. Use curl as suggested in the documentation https://netbox.readthedocs.io/en/stable/graphql-api/overview/#queries `curl -H "Authorization: Token $TOKEN" -H "Content-Type: application/json" -H "Accept: application/json" http://localhost/graphql/ --data '{"query": "query {circuits(status:\"active\" {cid provider {name}}}"}' ` ### Expected Behavior GraphQL json data is being returned. Already tried to set the ALLOWED_HOST to * but same result. See also the discussion here https://github.com/netbox-community/netbox/discussions/7182 ### Observed Behavior CSRF Error is raised ```>>> POST /graphql/ HTTP/1.1 Host: localhost:8001 User-Agent: curl/7.68.0 Authorization: Token <snip> Content-Type: application/json Accept: application/json Content-Length: 69 {"query": "query {circuits(status:\"active\" {cid provider {name}}}"} <<< HTTP/1.1 403 Forbidden Server: gunicorn Date: Sun, 05 Sep 2021 08:29:58 GMT Connection: keep-alive Content-Type: text/html X-Content-Type-Options: nosniff Referrer-Policy: same-origin X-Frame-Options: SAMEORIGIN Content-Length: 1382 Vary: Origin <!DOCTYPE html> <html lang="en"> <head> ... various stuff CSS ... </head> <body> <div id="summary"> <h1>Forbidden <span>(403)</span></h1> <p>CSRF verification failed. Request aborted.</p> <p>You are seeing this message because this site requires a CSRF cookie when submitting forms. This cookie is required for security reasons, to ensure that your browser is not being hijacked by third parties.</p> <p>If you have configured your browser to disable cookies, please re-enable them, at least for this site, or for ...same-origin... requests.</p> </div> <div id="explanation"> <p><small>More information is available with DEBUG=True.</small></p> </div> </body> </html>```
adam added the type: bugstatus: accepted labels 2025-12-29 19:26:55 +01:00
adam closed this issue 2025-12-29 19:26:55 +01:00
adam commented 2025-12-29 19:26:56 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Sep 9, 2021):

I'm not sure what the root problem is here. It seems like the GraphQL API request is getting caught by Django's CSRF middleware, though I can't think of what might have changed to cause that. Incidentally, changing the request type to GET (e.g. curl -X GET ... works.

We do have tests in place for all the GraphQL queries, however they're all passing as expected with POST requests. I assume this is because the test suite's dummy request/response workflow doesn't actually pass through the middleware. Need to dig into that further as well.

@jeremystretch commented on GitHub (Sep 9, 2021): I'm not sure what the root problem is here. It seems like the GraphQL API request is getting caught by Django's CSRF middleware, though I can't think of what might have changed to cause that. Incidentally, changing the request type to GET (e.g. `curl -X GET ...` works. We do have tests in place for all the GraphQL queries, however they're all passing as expected with POST requests. I assume this is because the test suite's dummy request/response workflow doesn't actually pass through the middleware. Need to dig into that further as well.
adam commented 2025-12-29 19:26:56 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Sep 9, 2021):

@arjenvri suggested:

i wonder if a csrf_exempt should be implemented for graphql. This is one of the suggestions mentioned in the graphene-django docs.

Wrapping the invocation of GraphQLView in csrf_exempt() does resolve the issue. It just bugs me because this was definitely working before with POST requests, and I haven't been able to determine what's changed.

@jeremystretch commented on GitHub (Sep 9, 2021): @arjenvri [suggested](https://github.com/netbox-community/netbox/discussions/7182#discussioncomment-1282111): > i wonder if a csrf_exempt should be implemented for graphql. This is one of the suggestions mentioned in the graphene-django docs. Wrapping the invocation of GraphQLView in `csrf_exempt()` does resolve the issue. It just bugs me because this was definitely working before with POST requests, and I haven't been able to determine what's changed.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: accepted type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#5345
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?