title: Setting Django CSRF Cookie
body: <p>I'm using React as front and Django as back. Httprequest fails, prompting that the CSRF Cookie is not set. I have followed <a href="https://docs.djangoproject.com/en/2.0/ref/csrf/" rel="nofollow noreferrer">the django docs,</a>I have this code:</p>
  
  <pre><code>var jQuery = require("jquery");
  // using jQuery
  function getCookie(name) {
      var cookieValue = null;
      if (document.cookie &amp;&amp; document.cookie !== '') {
          var cookies = document.cookie.split(';');
          for (var i = 0; i &lt; cookies.length; i++) {
              var cookie = jQuery.trim(cookies[i]);
              // Does this cookie string begin with the name we want?
              if (cookie.substring(0, name.length + 1) === (name + '=')) {
                  cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
                  break;
              }
          }
      }
      return cookieValue;
  }
  
  let header = new Headers({
    "X-CSRFToken": getCookie("csrftoken"),
    "Content-Type": "application/json; charset=utf-8",
    "Access-Control-Request-Headers": "*",
    "Access-Control-Allow-Methods": "GET, POST, HEAD, OPTIONS, PUT, DELETE, PATCH"
  });
  </code></pre>
  
  <p>Using <code>console.log(getCookie("csrftoken"));</code> prints <em>null</em>, which leads me to believe that Django is not setting the cookie.</p>
  
  <p>My middleware looks like this:</p>
  
  <pre><code>MIDDLEWARE = [
      'corsheaders.middleware.CorsMiddleware',
      'django.middleware.security.SecurityMiddleware',
      'django.contrib.sessions.middleware.SessionMiddleware',
      'django.middleware.common.CommonMiddleware',
      'django.middleware.csrf.CsrfViewMiddleware',
      'django.contrib.auth.middleware.AuthenticationMiddleware',
      'django.contrib.messages.middleware.MessageMiddleware',
      'django.middleware.clickjacking.XFrameOptionsMiddleware',
  ]
  </code></pre>
  
  <p>Early in development I used this view for testing:</p>
  
  <pre><code>@ensure_csrf_cookie
  def token(request):
      if request.method == 'GET':
          return HttpResponse(status=204)
      else:
          return HttpResponseNotAllowed(['GET'])
  </code></pre>
  
  <p>This works well, but it does not feel very clean to call this everytime the user uses the website.</p>
  
  <p>The view that is failing:</p>
  
  <pre><code>def loginView(request):
      if request.method == 'POST':
          username = json.loads(request.body.decode())['username']
          password = json.loads(request.body.decode())['password']
          user = authenticate(username=username, password=password)
          if user is not None:
              login(request, user)
              return HttpResponse(status=200) #OK
          else:
              return HttpResponse(status=401) #DENIED
      else:
          return HttpResponseNotAllowed(['POST'])
  </code></pre>
  
  <p>I am using a few more views, and they also fail if I do not provide a CSRF key.</p>