class SessionMiddleware(object):
    def process_request(self, request):
        if getattr(request, 'user', None) and request.user.is_authenticated():
            return
        session = request.session
        # Ensure the session is created view processing, but only if a cookie
        # had been previously set. This is to prevent creating exorbitant
        # numbers of sessions non-browser clients, such as bots.
        if session.session_key is None:
            if session.test_cookie_worked():
                session.delete_test_cookie()
                request.session.create()
            else:
                session.set_test_cookie()

from .tokens import get_request_token


class SessionMiddleware(object):
    def process_request(self, request):
        if getattr(request, 'user', None) and request.user.is_authenticated():
            return

        # Token-based authentication is attempting to be used, bypass CSRF
        # check
        if get_request_token(request):
            request.csrf_processing_done = True
            return

        session = request.session
        # Ensure the session is created view processing, but only if a cookie
        # had been previously set. This is to prevent creating exorbitant
        # numbers of sessions for non-browser clients, such as bots.
        if session.session_key is None:
            if session.test_cookie_worked():
                session.delete_test_cookie()
                request.session.create()
            else:
                session.set_test_cookie()

Update SessionMiddleware to bypass CSRF if request token is present
Update SessionMiddleware to bypass CSRF if request token is present

For non-session-based authentication, Serrano resources handle
authenticating using a token based approach. If it is present, CSRF
must be turned off to exempt the resources from the check.

+ from .tokens import get_request_token
+ 
+ 
  class SessionMiddleware(object):
      def process_request(self, request):
          if getattr(request, 'user', None) and request.user.is_authenticated():
              return
+ 
+         # Token-based authentication is attempting to be used, bypass CSRF
+         # check
+         if get_request_token(request):
+             request.csrf_processing_done = True
+             return
+ 
          session = request.session
          # Ensure the session is created view processing, but only if a cookie
          # had been previously set. This is to prevent creating exorbitant
-         # numbers of sessions non-browser clients, such as bots.
+         # numbers of sessions for non-browser clients, such as bots.
          if session.session_key is None:
              if session.test_cookie_worked():
                  session.delete_test_cookie()
                  request.session.create()
              else:
                  session.set_test_cookie()
  
Update SessionMiddleware to bypass CSRF if request token is present
## Code Before:
class SessionMiddleware(object):
    def process_request(self, request):
        if getattr(request, 'user', None) and request.user.is_authenticated():
            return
        session = request.session
        # Ensure the session is created view processing, but only if a cookie
        # had been previously set. This is to prevent creating exorbitant
        # numbers of sessions non-browser clients, such as bots.
        if session.session_key is None:
            if session.test_cookie_worked():
                session.delete_test_cookie()
                request.session.create()
            else:
                session.set_test_cookie()

## Instruction:
Update SessionMiddleware to bypass CSRF if request token is present
## Code After:
from .tokens import get_request_token


class SessionMiddleware(object):
    def process_request(self, request):
        if getattr(request, 'user', None) and request.user.is_authenticated():
            return

        # Token-based authentication is attempting to be used, bypass CSRF
        # check
        if get_request_token(request):
            request.csrf_processing_done = True
            return

        session = request.session
        # Ensure the session is created view processing, but only if a cookie
        # had been previously set. This is to prevent creating exorbitant
        # numbers of sessions for non-browser clients, such as bots.
        if session.session_key is None:
            if session.test_cookie_worked():
                session.delete_test_cookie()
                request.session.create()
            else:
                session.set_test_cookie()
