I’m currently working on a login system that needs a POST request and csrf authentication, so I started to work with postman and trying to send requests and took the snippet provided by the generator:

const myHeaders = new Headers();
myHeaders.append("X-CSRFToken", "OmgnDDPPS4TRcERF3XNuYw4uJ3OBSwmmSq7ktjM5wX2oT02DWuWZwX57BOOLCA3h");
myHeaders.append("Cookie", "csrftoken=OmgnDDPPS4TRcERF3XNuYw4uJ3OBSwmmSq7ktjM5wX2oT02DWuWZwX57BOOLCA3h");

const requestOptions = {
  method: "POST",
  headers: myHeaders,
  redirect: "follow"
};

fetch("http://127.0.0.1:8000/simulazione/api/prova_token/", requestOptions)
  .then((response) => response.text())
  .then((result) => console.log(result))
  .catch((error) => console.error(error));

The request above works in postman but if I took this code and write it in nextjs a got the forbidden error
[30/Apr/2024 13:11:47] "POST /simulazione/api/prova_token/ HTTP/1.1" 403 2869

These below are the django view and settings:
View

@csrf_protect
def prova_token(request):
    
    if request.method == 'POST':
    
        return JsonResponse("hello", safe=False)

Settings

CORS_ORIGIN_ALLOW_ALL = True
CORS_ALLOW_CREDENTIALS = True

#CSRF_COOKIE_SECURE = False
CSRF_COOKIE_HTTPONLY = False
SESSION_COOKIE_SECURE = False
SESSION_COOKIE_SAMESITE = None

ALLOWED_HOSTS = [ ]
CSRF_TRUSTED_ORIGINS = ["http://127.0.0.1:3000","http://localhost:3000"]

CORS_ALLOW_HEADERS = [
'accept',
'accept-encoding',
'authorization',
'content-type',
'dnt',
'origin',
'user-agent',
'x-csrftoken',
'csrftoken',
'x-requested-with',
]

CORS_ALLOW_METHODS = [
'DELETE',
'GET',
'OPTIONS',
'PATCH',
'POST',
'PUT',
]

CORS_ALLOWED_ORIGINS = [
    'http://127.0.0.1:3000',
    'http://localhost:3000',
]
# Application definition

INSTALLED_APPS = [
    'corsheaders',
    'simulazione.apps.SimulazioneConfig',
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'django_nextjs',    
    'rest_framework',
]

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'corsheaders.middleware.CorsMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

I tried to make the request sending the csfr as header and I expected to access the method of the view