When making a POST request via AJAX without an HTML form, do security issues arise? Why does no csrf error occur even though no csrf data is being sent and csrf is enabled in Django?
toggle-status.js
jQuery(document).ready(function($) {
$("#switch-status").click(function(){
$.ajax({
url: '/account/switches/',
data: {'toggle': 'status'}
});
});
});
view.py
@login_required
def switches(request):
toggle = request.GET.get('toggle', None)
current_user = request.user
update = Switches.objects.get(owner=current_user)
if toggle == 'status':
if update.status is True:
update.status = False
else:
update.status = True
update.save()
return HttpResponse('')