# Bad CSRF on request from cloned session with Python

**URL:** <https://meta.discourse.org/t/bad-csrf-on-request-from-cloned-session-with-python/198348>\
**Category:** Development\
**Tags:** rest-api\
**Created:** [July 27, 2021, 7:17pm UTC](https://meta.discourse.org/t/bad-csrf-on-request-from-cloned-session-with-python/198348 "2021-07-27T19:17:42Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![blake](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/blake/32/157322_2.png) [@blake](https://meta.discourse.org/u/blake)\
**Post date:** [July 28, 2021, 2:36pm UTC](https://meta.discourse.org/t/bad-csrf-on-request-from-cloned-session-with-python/198348/2 "2021-07-28T14:36:03Z")

</div>

Will this be used by all users, just staff, or just yourself? I guess what I’m getting at if this is just for you to help with moderation it would be best to use an api key or to generate some api keys for specific staff users.

---

_[View the full topic](https://meta.discourse.org/t/bad-csrf-on-request-from-cloned-session-with-python/198348)._