Getting ["BAD CSRF"] when updating topic via API [python]

Dev
1

Hey folks, I am having issues updating a topic. I am able to get the id of the first post as shown here. This is confirmed by running the following:

import requests from requests.structures import CaseInsensitiveDict url = "https://my/discourse/instance/posts/{post_id}.json" headers = CaseInsensitiveDict() headers["Authorization"] = "{"api-key": "{le_api_key}", "api-username": "{le_username}"}" resp = requests.get(url, headers=headers) print(resp.status_code)

Which returns a 200 status code and the info I expected about the post.

But when I try:

import requests from requests.structures import CaseInsensitiveDict url = "https://my/discourse/instance/posts/{post_id}.json" headers = CaseInsensitiveDict() headers["Authorization"] = "{"api-key": "le_api_key", "api-username": "le_username"}" headers["Content-Type"] = "application/json" data = """ { "post": { "raw": "Cool post, but here's an updated to the post's body", "edit_reason": "I changed this because I can." } } """ resp = requests.put(url, headers=headers, data=data) print(resp.status_code)

I get
["BAD CSRF"]

I am an admin and my key is global. Ideally I would like to run this with a less permissive key.
This post is the first and only in a topic a created via the API.

Thank you so much in advance :slight_smile:

2

Why are you nesting the headers under this Authorization dict key? That is not documented at Discourse REST API Documentation :thinking:

2 Likes
3

You are right, that’s something the tool I am using to test the API is doing and it works and that’s a problem on itself apparently:

header1 = CaseInsensitiveDict() header1["Authorization"] = '{"api-key": "longapikey", "api-username": "myusername"}' header2 = {"api-key": "longapikey", "api-username": "myusername"} r = requests.get(url, headers= HEADER)

When HEADER == header1, it works, when == header2, I get:

{"errors":["You are not permitted to view the requested resource. The API username or key is invalid."],"error_type":"invalid_access"}

Thanks for your reply btw!