# Bad CSRF on request from cloned session with Python

**URL:** <https://meta.discourse.org/t/bad-csrf-on-request-from-cloned-session-with-python/198348>\
**Category:** Development\
**Tags:** rest-api\
**Created:** [July 27, 2021, 7:17pm UTC](https://meta.discourse.org/t/bad-csrf-on-request-from-cloned-session-with-python/198348 "2021-07-27T19:17:42Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![Hans](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/hans/32/97608_2.png) [@Hans](https://meta.discourse.org/u/Hans)\
**Post date:** [July 27, 2021, 7:17pm UTC](https://meta.discourse.org/t/bad-csrf-on-request-from-cloned-session-with-python/198348/1 "2021-07-27T19:17:43Z")

</div>

I am a moderator on a Discourse forum and I wanted to write a python program that will clone the session cookies out of the browser and run a simple user action like liking a post. I successfully cloned the session and was able to use GET requests to get any page, even private categories (so I know the session has been successfully cloned), but when I tried to simply like a post with a POST request I got “Bad CSRF” and upon investigation I noticed that no CSRF token was being generated in the request. I want to know why CSRF tokens will generate in the browser, but not in this cloned session. Is there a way I can get a CSRF token for the request? My simple code is below.

```plaintext
import requests
import browsercookie

cj = browsercookie.firefox()

r = requests.post("https://somediscoursesite.com/post_actions", data={'id':'theid','post_action_type_id':'2','flag_topic':'false'}, cookies=cj)

print(r.status_code)
print(r.request.headers)

```

---

_[View the full topic](https://meta.discourse.org/t/bad-csrf-on-request-from-cloned-session-with-python/198348)._