Django and Next.js can work together, but “integration” can mean two different architectures: a standalone Next.js frontend calling a Django API, or Django handling the initial page request and asking a separate Next.js server to render the page. Most confusing login, CSRF, and CORS bugs come from mixing these designs—or from assuming that a route rewrite also handles cookies and authentication.
For every request, trace its origin, destination, cookies, and security checks. A browser request and a request made during server rendering are not the same request, and they do not automatically share a cookie jar.
As an Amazon Associate I earn from qualifying purchases.
Choose the integration shape before debugging it
Next.js rewrites can map an incoming path to another destination while keeping the destination out of the browser’s address bar. As the Next.js rewrites documentation explains, a rewrite maps an incoming request path to a different destination. That is routing—not a configuration for Django sessions, CSRF, or permissions.
The other architecture is documented by the third-party django-nextjs project: Django receives an initial page request and uses a separately running Next.js server to render the page. Its repository says that a new project using Django purely as a standalone API backend does not need that package. Treat it as an option for its specific integration mode, not as a general Django-plus-Next.js requirement; check its current activity and compatibility with your versions before adopting it.
#1 Best Overall
| Question | Standalone Next.js frontend + Django API | Django-led rendering with a Next.js server |
|---|---|---|
| Who handles the browser’s page request? | Next.js serves the frontend; the browser also calls Django API endpoints, directly or through a configured proxy. | Django receives the initial page request and obtains rendered output from the Next.js server. |
| Where might API calls originate? | In the browser, or from Next.js server-side code if the application fetches data during rendering. | From Django to Next.js for rendering, and potentially from the browser or a Next.js server to Django for API work. |
| What must be deliberately designed? | Which service owns authentication, how the browser obtains and sends CSRF tokens, and whether browser-to-API requests are cross-origin. | How the separate rendering server is deployed, which requests carry user credentials, and how routing and assets work in the chosen setup. |
In either design, decide which system is authoritative for identity and sessions. Django REST framework’s AJAX, CSRF, and CORS guidance asks API builders to consider whether a JavaScript client can use the site’s authentication policy and whether CSRF tokens or CORS headers are needed. Do not assume that choosing Next.js settles those questions.
Trace the request, not just the URL
For a failing operation, write down the complete path from the user action to the Django view. The browser’s address bar shows a public URL; it does not tell you which server actually made the API request or which cookies accompanied it.
Rank #2
- Identify the requester. Is the API call made by browser JavaScript, by a Next.js server component or other server-side rendering code, or by Django while obtaining rendered output?
- Identify the recipient. Does the request go directly to Django, to a Next.js route that rewrites or proxies it, or to another service first?
- Inspect the request credentials. Which cookies or other credentials are present on that particular hop? Do not infer that a cookie held by one server is also stored in the user’s browser.
- Inspect the response path. Which server sent any session or CSRF cookie, and did that response reach the browser or only another server?
- Identify the Django checks. Determine which authentication, CSRF, and permission checks apply to the endpoint and request method. A successful route or CORS preflight does not itself grant access.
This request-by-request view is especially important when Next.js fetches Django during rendering. The Next.js server’s outbound request does not automatically inherit the browser’s cookie jar. If the server-side fetch needs the user’s Django session, the application must deliberately handle credentials arriving with the incoming request and decide how to handle cookies returned by Django. The correct mechanics depend on the deployed Next.js APIs and topology; verify them against the version in use rather than copying an example for a different setup.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Why a rewrite can work while you remain logged out
A rewrite can make an API path appear under the frontend’s public URL while routing it to Django behind the scenes. That can change whether a browser request is cross-origin, but it does not make a Django session cookie appear in the browser, forward a cookie from server-rendering code, or make cookie scope match the public host.
Trace both directions. If the browser sends a request through Next.js to Django, check what credentials reach Django and whether Django’s response—including any cookie—is passed back along a path that lets the browser receive it. If Next.js calls Django on the server, check separately what credentials the server forwards and what happens to Django’s response cookies. A rewrite is not a substitute for either design.
How to send Django’s CSRF token from Next.js
For AJAX requests, Django’s CSRF documentation recommends sending the token in the X-CSRFToken header. The client must first obtain the token through the relevant flow and make it available to the code issuing the unsafe request. The cookie’s presence cannot simply be assumed: Django warns that a CSRF cookie may not be set when no template containing {% csrf_token %} is rendered. Django documents ensure_csrf_cookie as an option when a response needs to force the cookie to be set.
- Check the token-producing response. Confirm that the browser or the server-side caller receives the CSRF token through the flow your application actually uses.
- Check the request that changes data. For an AJAX request, confirm that the token is sent in
X-CSRFTokenand that the corresponding cookie and request reach Django as intended. - Check the rejected request in Django. Identify whether the request lacked a token, used an unavailable token, or failed another applicable check; do not treat every CSRF 403 as the same failure.
Do not casually disable Django’s CSRF middleware to make a request succeed. First establish whether the endpoint uses cookie-based authentication and whether the client is following the required CSRF flow.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When CORS is—and is not—the problem
CORS is a browser policy relevant when browser JavaScript requests a different origin. Determine the origin of the browser page and the API endpoint actually called by the browser; a server-side request from Next.js to Django is not the same browser cross-origin request.
Best Value
A same-origin public route or proxy can avoid a browser-to-API cross-origin request in a particular topology. It does not authenticate the user, validate a CSRF token, or authorize an operation in Django. Conversely, if the browser calls Django on a separate origin, the API’s CORS behavior and its authentication and CSRF policy must be designed together. CORS permission is not proof of identity or authorization.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why browser login may not carry into server rendering
When a page renders on the Next.js server, any API request it makes to Django originates on that server. A user’s browser may have received a Django cookie, but the server does not automatically receive or reuse it. This explains a common pattern: an API call works in browser JavaScript but returns an anonymous response when repeated during server rendering.
Inspect the inbound request to Next.js, the credentials the rendering code forwards to Django, and the response cookies Django returns. Also establish whether those cookies need to reach the browser, remain internal to the server-side flow, or be transformed by application logic. Community discussions often phrase the confusion as “where to get the csrf_token” or “Cookie is received but not being saved”; those are useful descriptions of symptoms, not authoritative implementation instructions. Confirm cookie forwarding and response handling against the current APIs and deployment you use.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhat Next.js middleware can—and cannot—do
Next.js documents middleware as a place to run server code before a request completes, including inspecting or modifying headers and cookies and rewriting or redirecting requests. It can help with request flow, but it is not the final security boundary for protected Django data or mutations.
Keep Django responsible for authenticating and authorizing protected API operations. A request that passes through middleware, reaches a rewritten route, or carries a cookie still needs to satisfy the Django endpoint’s security checks. Apply middleware where it clarifies routing or request handling, not as a replacement for backend permissions.
Quick Recap
A practical diagnosis for the three common errors
“My POST gets a CSRF 403”
- Establish how the client obtains the CSRF token and whether Django’s response actually sets or exposes it in that flow.
- For AJAX, check the
X-CSRFTokenheader on the actual request reaching Django, along with the relevant cookies. - If the flow never renders a template with
{% csrf_token %}, consider Django’s documentedensure_csrf_cookieoption rather than disabling CSRF protection.
“CORS is blocking login”
- Confirm whether the failing request is made by the browser and is cross-origin; distinguish it from a server-side fetch.
- Check the API’s CORS behavior alongside its chosen authentication and CSRF policy.
- If using a same-origin proxy route, verify routing and cookie flow separately; a proxy does not replace Django authentication or authorization.
“It works in the browser but not in server rendering”
- Compare the browser request and the server-rendered request as separate requests, including their origins and credentials.
- Check whether the incoming request’s relevant cookies are deliberately forwarded to Django.
- Decide how any Django response cookies should be handled, and verify the implementation against the current Next.js version and your service topology.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
