# Bad CSRF on request from cloned session with Python

**URL:** <https://meta.discourse.org/t/bad-csrf-on-request-from-cloned-session-with-python/198348>\
**Category:** Development\
**Tags:** rest-api\
**Created:** [July 27, 2021, 7:17pm UTC](https://meta.discourse.org/t/bad-csrf-on-request-from-cloned-session-with-python/198348 "2021-07-27T19:17:42Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![Hans](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/hans/32/97608_2.png) [@Hans](https://meta.discourse.org/u/Hans)\
**Post date:** [July 29, 2021, 10:32pm UTC](https://meta.discourse.org/t/bad-csrf-on-request-from-cloned-session-with-python/198348/3 "2021-07-29T22:32:11Z")

</div>

I mean for it to be used by any logged-in user. Basically I want to take the user session and allow the user to perform actions with it programmatically with python, namely, liking posts. I know it would be way easier to use an admin key, but I want it to be available to any user and since a user can like a post in their browser why can’t that be performed programmatically from their own device with a cloned session in command prompt?

---

_[View the full topic](https://meta.discourse.org/t/bad-csrf-on-request-from-cloned-session-with-python/198348)._