A user indicated CSRF issues doing PUT/POST commands to the https:///netbox/api endpoint and also noted an inconvenience using https:///mapi/netbox, namely that since 3rd-party libraries always append /api to the URL it makes it hard to use the /mapi/netbox passthrough (which is already doing the /api already).
So two tasks for this:
- investigate the CSRF issues for PUT/POST (
CSRF_TRUSTED_ORIGINS will likely need to be set, but we should make sure it works as long as it is set correctly)
- adjust the
/mapi/netbox passthrough to either not prepend the /api to the request automatically, or to keep the current behavior in other cases but detect if /api is already on there, then don't append it.
A user indicated CSRF issues doing PUT/POST commands to the https:///netbox/api endpoint and also noted an inconvenience using https:///mapi/netbox, namely that since 3rd-party libraries always append
/apito the URL it makes it hard to use the /mapi/netbox passthrough (which is already doing the /api already).So two tasks for this:
CSRF_TRUSTED_ORIGINSwill likely need to be set, but we should make sure it works as long as it is set correctly)/mapi/netboxpassthrough to either not prepend the/apito the request automatically, or to keep the current behavior in other cases but detect if/apiis already on there, then don't append it.