The HTTP 403 error Forbidden (CSRF cookie not set.) in Django occurs when a POST, PUT, or DELETE request is submitted without a valid CSRF cookie token or when cross-origin request headers mismatch.

Django settings.py CSRF Configuration

settings.pypython
# Add trusted origin domains for cross-origin POST requests in Django 4.0+
CSRF_TRUSTED_ORIGINS = [
    'https://app.example.com',
    'http://localhost:3000'
]
 
# Ensure CSRF cookie is set for JavaScript clients
CSRF_COOKIE_HTTPONLY = False
CSRF_COOKIE_SAMESITE = 'Lax'