除了ajax request + django中缺少csrf令牌外，是否还有其他原因会导致403错误？

Question

The main reason of django + ajax 403 error is absence of csrf token, but in my case it's present and almost the same ajax function works fine. I'll also attach backend view function handling the response using djangorestframework.

  $.ajax({
    url: '/authsteptwo/',
    type:'POST',
    dataType: 'json',
    data: { phone_number : phone_number, email : email, csrfmiddlewaretoken: "{{ csrf_token }}" },
    success: function () {

      // alert('succes');
      setTimeout(
  function() 
  {
      alert('fine');
  }, 0);

    },
    error : function() {


        alert('fck');
    }


  })

view

@api_view(['POST', ])
def auth_step_two(request):
    if request.method == 'POST':
        phone_number = request.data['phone_number']
        email = request.data['email']
        # user = request.user.UserProfile
        # user.email = email
        # user.phone_number = phone_number
        # user.save()
    else:
        print("WTF")
    return Response(request.data)

console:

Failed to load resource: the server responded with a status of 403 (FORBIDDEN)

Are there any other reason which can cause 403 error ?

EDIT: I tried just to call ajax function out of all condition in the beggingign of the page, just after and it worked. But calling the same function onclick(without real data, so it's not related) fails wth 403 or also falls on jQuery click event. Very weird. Any suggestions what could it be?

EDIT: Oh, I figured out that no ajax function in fact working after first ajax auth call executed. I attach the code of first call which works and after that nothing works. Help me understand why?

 $.ajax({
    url: '/authfb/',
    type:'POST',
    dataType: 'json',
    data: {"fb_first_name": fb_first_name, "fb_last_name": fb_last_name, "fb_username": fb_username, "fb_email":fb_email, "fb_id":fb_id, "fb_link":fb_link, csrfmiddlewaretoken: "{{ csrf_token }}" },
    success: function () {

      // alert('succes');
      setTimeout(
  function() 
  {
    $('#hide_group').hide();
    $('#show_group').show();
    $('.loading_white_wall').fadeOut();
    $('.greeting_title_name').html(fb_first_name);
    if(fb_email){

      $(".email_input").prop("value", fb_email);
    }

    else{

        $(".email_input").prop("placeholder", 'E-mail');
    }


  }, 1000);

    },
    error : function(data) {

      $('#hide_group').hide();
      $('#error_group').show();
      $('.loading_white_wall').fadeOut();

    }


  })

And also the exact code of handler, there is much but possible something somehow related, but most likely no much use of it:

@api_view(['POST', ])
def authfb(request):
    require_more_data = True
    if request.method == 'POST':
        first_name = request.data['fb_first_name']
        last_name = request.data['fb_last_name']
        fb_username = request.data['fb_username']
        fb_id = int(request.data['fb_id'])
        fb_link = request.data['fb_link']
        username = fb_username.replace(' ', '')
        print(fb_link)
        print (type(fb_id))

        # print(username)
        password = '11442358'
        user = auth.authenticate(username=username, password=password)
        # print(type(username))
        # print(type(password))
        if user is not None:
            auth.login(request, user)
            username = auth.get_user(request).username
            print ('logged in succesfully')
            # user1 = UserProfile.user.objects.get(username=username)
            # if (user1.userprofile.phone_number):
            #     print ("hello")
            # email = auth.get_user(request).UserProfile.email
            # if phone_number and email:
            #     require_more_data = False
        else:
            user = User.objects.create_user(username=username, password=password)
            userprofile = UserProfile.objects.create(user=user, first_name=first_name, last_name=last_name)
            user = auth.authenticate(username=username, password=password)
            auth.login(request, user)
            print (userprofile)
    else:
        print("WTF")
    return Response(request.data)

Answer 1

I found a solution in one of my old projects. If someone explains why this works and previous is wrong, I'll mark as correct.

function getCookie(name) {
  var value = "; " + document.cookie;
  var parts = value.split("; " + name + "=");
  if (parts.length == 2) return parts.pop().split(";").shift();
}
var csrftoken = getCookie('csrftoken');
 $.ajaxSetup({
        headers: { "X-CSRFToken": getCookie("csrftoken") }
    });

in ajax call

    data: {"fb_first_name": fb_first_name,'csrfmiddlewaretoken': getCookie('csrftoken') },