# Forbidden (CSRF cookie not set.): /api/update/

- **ID:** `python/django-ajax-csrf-error`
- **Domain:** python
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

AJAX request does not include CSRF token in headers or cookie is missing.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 3.x | active | — | — |

## Workarounds

1. **** (95% success)
   ```
   Ensure CSRF cookie is set by using {% csrf_token %} in template, then include token in AJAX: headers: {'X-CSRFToken': getCookie('csrftoken')}
   ```
2. **** (90% success)
   ```
   Use Django's ensure_csrf_cookie decorator on the view that returns the page.
   ```

## Dead Ends

- **** — Adding @csrf_exempt to view bypasses security, not recommended. (80% fail)
- **** — Hardcoding CSRF token in JavaScript doesn't work as it changes per session. (70% fail)