toastdriven/restless — pull request #22 by selectnull (2014-07-06 17:54:20+00:00)
Title: Call csrf_exempt on DjangoResource.as_view.

For any custom endpoints that are not HTTP GET, csrf exemption
is needed or the call will fail with HTTP 403.

One might argue that this fix smells like someone wanting to implement rpc-like endpoints and one would not be necessarily wrong :) Nevertheless, API endpoints should not be protected with CSRF and this fix is consistent with `as_list` and `as_detail` methods.

I haven't written a test because FakeHTTPRequest does not trigger CSRF so it wasnt just a case of writing another test; if you find this pull request valid I would like to implement proper tests.