Why do I get a 403 Forbidden error when using @csrf_exempt in the AJAX query?


I am trying to write a very basic AJAX request in Django, and I keep getting the 403 forbidden error in both the Chrome Dev and Django consoles. I posted a similar question the other day and have tried all of the proposed solutions including @csrf_exempt (to rule out if this is even a csrf issue), I have tried including csrfmiddlewaretoken: '{{ csrf_token }}' in the AJAX POST request (underneath data), this did not resolve the issue either. Here is my code.

def profile_listview(request, username,
    extra_context=None, **kwargs):
    user = get_object_or_404(get_user_model(),
    fullsalelist = Entry.objects.filter(author__username__iexact=username)

    def delete_object(request):
        if request.is_ajax():
            print "request is ajax"
            object_name = request.POST.get('entryname')
            targetobject = Entry.objects.get(headline=object_name)
            if request.user.username == targetobject.author:
                print "hello"
            return HttpResponseRedirect('/storefront/')

And AJAX code in the template:

<script type="text/javascript">
    var my_app = {
      username: "{{ request.user.username }}"

 $(document).ready(function() {
    $(".delete_button").click(function() {
        var id = $(this).attr('id');
            type: "POST",
            url: "/accounts/" + my_app.username + "/listview/",
            data: { entryname:id },
        return false;


(r'^accounts/(?P<username>[\@\.\w-]+)/listview/$', profile_listview),

Things worth noting:

  1. I have csrf middleware turned on in my settings

  2. inside the jQuery AJAX code, url and data are both sending the correct information

  3. When I click the delete button, I get the 403 forbidden error.

  4. The print "request is ajax" does not print in the console (or anywhere).

I am also confused because I am getting conflicting information. I was told I should add the csrf value via javascript (https://docs.djangoproject.com/en/1.7/ref/contrib/csrf/). This leaves me with 2 questions. 1. How is this any different than adding csrfmiddlewaretoken: '{{ csrf_token }}' in my POST request? and 2. More importantly, doesn't the fact that I still get a 403 error when using @csrf_exempt kind of make this a moot point?

To my understanding, delete_object is a function inside profile_listview, but the profile_listview didn't call it. Therefore, the profile_listview has no http response. Post the error message