# my request.user is always AnonymousUser

**URL:** <https://forum.djangoproject.com/t/my-request-user-is-always-anonymoususer/23581>\
**Category:** Forms & APIs\
**Created:** [September 2, 2023, 1:26am UTC](https://forum.djangoproject.com/t/my-request-user-is-always-anonymoususer/23581 "2023-09-02T01:26:53Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![yutianyang1](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/yutianyang1/32/7971_2.png) [@yutianyang1](https://forum.djangoproject.com/u/yutianyang1)\
**Post date:** [September 2, 2023, 1:26am UTC](https://forum.djangoproject.com/t/my-request-user-is-always-anonymoususer/23581/1 "2023-09-02T01:26:53Z")

</div>

# this is my login.py

```auto
import json

from django.http import JsonResponse
from django.contrib.auth import authenticate,login

def signin(request):
    data = json.loads(request.body.decode('utf-8'))
    username = data.get('username').strip()
    password = data.get('password').strip()
    user = authenticate(request,username=username,password=password)
    if not user:
        return JsonResponse({
                'result':"username or password not correct"
            })
    login(request,user)
    print(user)
    return JsonResponse({
        'result':"success",
        })

```

# this is my getinfo.py

```auto
import json

from django.http import JsonResponse
from django.views.decorators.csrf import csrf_exempt

from nlp_back.models.ailaber.ailaber import Ailaber

def getinfo_web(request):
    user = request.user
    print(user)
    if not user.is_authenticated:
        return JsonResponse({
            "result": "unlogged",
                    })
    else:
        player = Ailaber.objects.get(user=user)
        return JsonResponse({
            "result": "success",
            "username": player.user.username,
            "photo": player.photo,
            })
def getinfo(request):
    return getinfo_web(request)

```

# this is my vue3 code

```auto
await axios.post('http://localhost:8000/settings/login/',{
      username:form.username,
      password:form.password,
    }).then(res=>{
      if(res.data.result==='success'){
        axios.post('http://localhost:8000/settings/getinfo/').then(res=>{
        if(res.data.result==='unlogged'){
          console.log(res);
          
        }else{
          console.log(res);
          
        }
      }).catch(e=>{
        console.log(e)
      })
        //router.push({path:'/'});
      }else{
        login_text.value = res.data.result;
      }
    }).catch(e=>{
      console.log(e);
    })

```

the request.user is always AnonymousUser after login,why?

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [September 2, 2023, 2:09am UTC](https://forum.djangoproject.com/t/my-request-user-is-always-anonymoususer/23581/2 "2023-09-02T02:09:55Z")

</div>

I’d start by adding a couple more print statements to your signin view to verify what data you’re seeing at every step. Check to make sure that `data` is what you expect it to be. Check that the `username` and `password` being retrieved from `data` are what you expect them to be. Check to see what `user` is immediately after the `authenticate` function.

In other words, don’t make assumptions about the data you have or are receiving.

---

<div class="post-metadata">

**Author:** ![yutianyang1](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/yutianyang1/32/7971_2.png) [@yutianyang1](https://forum.djangoproject.com/u/yutianyang1)\
**Post date:** [September 2, 2023, 2:21am UTC](https://forum.djangoproject.com/t/my-request-user-is-always-anonymoususer/23581/3 "2023-09-02T02:21:23Z")

</div>

thank you,after

```auto
user = authenticate(request,username=username,password=password)
print(user)

```

the user is correct,but in getinfo.py,the `request.user` is AnonymousUser

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [September 2, 2023, 2:25am UTC](https://forum.djangoproject.com/t/my-request-user-is-always-anonymoususer/23581/4 "2023-09-02T02:25:54Z")

</div>

Then the next thing to check would be to see what the session id cookie is during this sequence.

- What is being submitted during the login request,
- What is being returned in that response,
- What you’re then sending back in your follow-up request to `getinfo_web`.

---

<div class="post-metadata">

**Author:** ![antoinehumbert](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/antoinehumbert/32/14851_2.png) [@antoinehumbert](https://forum.djangoproject.com/u/antoinehumbert)\
**Post date:** [September 2, 2023, 6:56am UTC](https://forum.djangoproject.com/t/my-request-user-is-always-anonymoususer/23581/5 "2023-09-02T06:56:34Z")

</div>

Hi.

If your vue3 code is not served by the same domain as your django API (i.e. localhost:8000), you may be facing a cross domain issue.

If so, to ensure session cookie is sent in subsequent requests after login, you need to set `withCredentials` attribute to `true` in the request. E.g.

`axios.post('http://localhost:8000/settings/getinfo/', { withCredentials: true })`

You may also enforce this behaviour for every request by setting  
`axios.defaults.withCredentials`

You’ll also have to correcty set CORS settings on django side (see [Be logged in mutiple sites - #13 by antoinehumbert](https://forum.djangoproject.com/t/be-logged-in-mutiple-sites/22501/13))

But, as stated by Ken, checking requests/responses headers from your browser should help in identifying the root cause of the problem

---

<div class="post-metadata">

**Author:** ![yutianyang1](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/yutianyang1/32/7971_2.png) [@yutianyang1](https://forum.djangoproject.com/u/yutianyang1)\
**Post date:** [September 2, 2023, 7:30am UTC](https://forum.djangoproject.com/t/my-request-user-is-always-anonymoususer/23581/6 "2023-09-02T07:30:19Z")

</div>

thank you so much,after adding the `axios.defaults.withCredentials`,there is an error in my browser:`Access to XMLHttpRequest at 'http://localhost:8000/settings/login/' from origin 'http://localhost:8080' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Credentials' header in the response is '' which must be 'true' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.`

---

<div class="post-metadata">

**Author:** ![antoinehumbert](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/antoinehumbert/32/14851_2.png) [@antoinehumbert](https://forum.djangoproject.com/u/antoinehumbert)\
**Post date:** [September 2, 2023, 7:44am UTC](https://forum.djangoproject.com/t/my-request-user-is-always-anonymoususer/23581/7 "2023-09-02T07:44:01Z")

</div>

This is where CORS configuration on the backend come into play.

See my previous post and define at least following settings:

```auto
CORS_ALLOWED_ORIGINS = ["http://the.domain.of.vue.app"]
CORS_ALLOW_CREDENTIALS = True

```

But, before going further, can you tell what is the domain serving the Vue app ? And, did you checked the request/response contents in The original scenario ?

---

<div class="post-metadata">

**Author:** ![yutianyang1](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/yutianyang1/32/7971_2.png) [@yutianyang1](https://forum.djangoproject.com/u/yutianyang1)\
**Post date:** [September 2, 2023, 7:54am UTC](https://forum.djangoproject.com/t/my-request-user-is-always-anonymoususer/23581/8 "2023-09-02T07:54:27Z")

</div>

my vue app is running by node.js in localhost,after adding

```auto
CORS_ALLOWED_ORIGINS = ["http://localhost:8080"]
CORS_ALLOW_CREDENTIALS = True

```

there is an error in my backend `Forbidden (CSRF cookie not set.): /settings/getinfo/`

---

<div class="post-metadata">

**Author:** ![antoinehumbert](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/antoinehumbert/32/14851_2.png) [@antoinehumbert](https://forum.djangoproject.com/u/antoinehumbert)\
**Post date:** [September 2, 2023, 8:04am UTC](https://forum.djangoproject.com/t/my-request-user-is-always-anonymoususer/23581/9 "2023-09-02T08:04:05Z")

</div>

There is actually no reason for your get\_info view to be called in post, so you may consider using `axios.get` instead of `axios.post` for this one.

If you really want to do POST, you can wrap your view with `@csrf_exempt` decorator

---

<div class="post-metadata">

**Author:** ![yutianyang1](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/yutianyang1/32/7971_2.png) [@yutianyang1](https://forum.djangoproject.com/u/yutianyang1)\
**Post date:** [September 2, 2023, 8:33am UTC](https://forum.djangoproject.com/t/my-request-user-is-always-anonymoususer/23581/10 "2023-09-02T08:33:27Z")

</div>

thank you so much,my problem has been solved now.

---

<div class="post-metadata">

**Author:** ![yutianyang1](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/yutianyang1/32/7971_2.png) [@yutianyang1](https://forum.djangoproject.com/u/yutianyang1)\
**Post date:** [September 2, 2023, 8:40am UTC](https://forum.djangoproject.com/t/my-request-user-is-always-anonymoususer/23581/11 "2023-09-02T08:40:01Z")

</div>

sorry,there is still problem with my code,my vue3 code

```auto
await axios.get('http://localhost:8000/settings/login/',{
      username:form.username,
      password:form.password,
    }).then(res=>{
      if(res.data.result==='success'){
        router.push({path:'/'});
      }else{
        login_text.value = res.data.result;
      }
    }).catch(e=>{
      console.log(e);
    })

```

has send password and username,but `request.GET` is `<QueryDict: {}>`

---

<div class="post-metadata">

**Author:** ![antoinehumbert](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/antoinehumbert/32/14851_2.png) [@antoinehumbert](https://forum.djangoproject.com/u/antoinehumbert)\
**Post date:** [September 2, 2023, 9:13am UTC](https://forum.djangoproject.com/t/my-request-user-is-always-anonymoususer/23581/12 "2023-09-02T09:13:26Z")

</div>

You must use .post for the login view, not get. I told using .get for the getinfo view only.

If you have a csrf error with the login view, wrap it with `@csrf_exempt` (see [Cross Site Request Forgery protection | Django documentation | Django](https://docs.djangoproject.com/en/4.2/ref/csrf/#django.views.decorators.csrf.csrf_exempt))

---

<div class="post-metadata">

**Author:** ![yutianyang1](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/yutianyang1/32/7971_2.png) [@yutianyang1](https://forum.djangoproject.com/u/yutianyang1)\
**Post date:** [September 2, 2023, 9:15am UTC](https://forum.djangoproject.com/t/my-request-user-is-always-anonymoususer/23581/13 "2023-09-02T09:15:08Z")

</div>

thank you,I changed the vue3 code to

```auto
params:{
        username:form.username,
        password:form.password,
      }

```

and the request.GET can get the username and password.