title: AngularJS + Django Rest Framework + CORS ( CSRF Cookie not showing up in client )
body: <p>I am developing a 1-page application in AngularJS using and Django Rest Framework + Django CORS Headers.</p>
  
  <p>My problem is that the "csrftoken" cookie never shows up in my browser when I have contacted the backend.</p>
  
  <p>For example: I am doing a login using a post. I get the "sessionid" cookie properly but the "csrftoken" never shows up and therefor I cannot do proper posts from my client since I will get denied due the lack of the csrf token.</p>
  
  <ul>
  <li>I have analyzed the response headers from the API and the csrftoken is not ther.</li>
  <li>I have looked directly in the rest API browser and it shows up fine there.</li>
  <li>Just to point out, I can do my first POST to login since Django Rest Framework only forces CSRF for   authenticated users. If I try to relogin it will fail since the "sessionid"-cookie it present.</li>
  <li>I am not interessted in bypassing the CSRF protection as some posts on stackoverflow suggests.</li>
  </ul>
  
  <p>Some code snippets from front/backend. These are unfinnished snippets, so dont get hung up on poorly written code.</p>
  
  <h1>Backend API LoginView</h1>
  
  <pre><code>class LoginView(APIView):
  
  renderer_classes = (JSONPRenderer, JSONRenderer)
  
  def post(self, request, format=None):
      serializer = LoginSerializer(data=request.DATA)
  
      if serializer.is_valid():
          userAuth = authenticate(username=serializer.data['username'], password=serializer.data['password'])
  
          if userAuth:
  
              if userAuth.is_active:
                  login(request, userAuth)
  
                  loggedInUser = AuthUserProfile.objects.get(pk=1)
                  serializer = UserProfileSerializer(loggedInUser)
  
                  user = [serializer.data, {'isLogged': True}]
  
  
  
          else:
              user = {'isLogged': False}
  
          return Response(user, status=status.HTTP_200_OK)
  
      return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
  </code></pre>
  
  <h1>Client side AngularJS Login Controller</h1>
  
  <pre><code>.controller('LoginCtrl', ['$scope', '$http', 'uService', '$rootScope', function(scope, $http, User, rootScope) {
  
  scope.login = function() {
  
      var config = {
          method: 'POST',
          withCredentials: true,
          url: rootScope.apiURL+'/user/login/',
          data : scope.loginForm
      };
  
      $http(config)
      .success(function(data, status, headers, config) {
  
          if (status == 200) {
              console.log(data[0]); //Test code
              // succefull login
              User.isLogged = true;
              User.username = data.username;
  
          }
          else {
              console.log(data); //Test code
              User.isLogged = false;
              User.username = '';
          }
  
      })
      .error(function(data, status, headers, config) {
          console.log('Testing console error');
          User.isLogged = false;
          User.username = '';
      });
  };
  </code></pre>
  
  <p>}]);</p>
  
  <p>Anyone with any good tips/ideas/examples?</p>