Debug CSRF and JWT authentication issues in Django projects.
npx skills add https://github.com/allthriveai/allthriveai --skill csrf-auth-debugger
Please help me install this Agent Skill. Skill: csrf-auth-debugger Source: https://github.com/allthriveai/allthriveai/tree/main/.claude/skills/csrf-auth-debugger Command: npx skills add https://github.com/allthriveai/allthriveai --skill csrf-auth-debugger
This Skill helps you diagnose CSRF verification failures, authentication problems, and OAuth flow issues across your Django/DRF setup.
Request the CSRF token endpoint to set the cookie, then attempt a login or write operation, verifying cookies and headers are correctly sent and accepted.
High-intent search queries and answers about installing and using this skill.
CSRF token verification failures occur when the csrftoken cookie and X-CSRFToken header don't align. Verify the token endpoint sets the cookie, confirm your frontend sends the header with each POST/PUT/DELETE request, and check that cookie domain, path, and SameSite policies match your CORS configuration.
403 errors typically indicate CSRF validation failed or the JWT token wasn't sent correctly. Verify httpOnly cookies contain the JWT, the X-CSRFToken header is present, Django CSRF middleware is enabled, and your Axios requests include credentials and the CSRF token from the cookie.
OAuth callback errors stem from token refresh failures, misaligned redirect URIs, or missing environment configuration. Check django-allauth settings, validate the access and refresh token exchange, inspect callback URL configuration, and verify your token service endpoint is accessible and returning valid JWTs.
Set httpOnly, Secure, and SameSite flags on CSRF and JWT cookies to prevent XSS attacks and cross-site requests. Configure Axios to send credentials with each request, extract and include the csrftoken in the X-CSRFToken header, and align your CORS trusted origins with your frontend domain.
Yes. Django REST Framework supports JWT authentication with httpOnly cookies. Configure your token service to issue JWTs in httpOnly cookies, set up django-allauth for OAuth flows, enable CSRF middleware, and ensure your frontend sends the X-CSRFToken header on state-changing requests.
Token refresh fails when the refresh endpoint doesn't receive the JWT, CSRF validation rejects the request, or cookie attributes block transmission. Verify the refresh token is stored in an httpOnly cookie, Axios sends credentials, the X-CSRFToken header is included, and your Django token service is configured to accept both.
alexsandrocruzConfigure OAuth 2.0, OpenID Connect, and JWT authentication in ASP.NET Core.
b-open-ioIntegrate Sigma Auth OAuth into Next.js applications with the @sigma-auth/better-auth-plugin.
otoshekConfigure django-allauth headless authentication with MFA and REST endpoints.
pascallammersResearch authentication and authorization patterns for Next.js and Drizzle ORM.
