in settings.py:

#SESSION_COOKIE_SAMESITE = 'Strict'
SESSION_COOKIE_HTTPONLY = True
#CSRF_COOKIE_SECURE = True
#SESSION_COOKIE_SECURE = True

CSRF_TRUSTED_ORIGINS = [ "http://localhost:3000",'http://127.0.0.1:8000']

in views.py:

@method_decorator(csrf_protect,name='dispatch')
class LoginView(views.APIView):
    permission_classes = [AllowAny,]
    serializer_class = serializer.LoginSerializer
    def post(self,request):
        data = serializer.LoginSerializer(data=request.data)
        print(data.is_valid())
        print(data.errors)
        if data.is_valid():
            email = data.data['email']
            password = data.data['password']
            auth = authenticate(username=email,password=password)
            if auth:
                login(request,auth)
                return HttpResponse(request.session.session_key
                ,status=200)
            else:
                print(password == "")
                if email == "" and password =="":
                    return HttpResponse('both email and password field are empty',status=400)

                elif email == "":
                    return HttpResponse('email field is empty',status=400)
                elif password == "":
                    print("Here")
                    return HttpResponse('passowrd field is empty',status = 400)

the problems occur in frontend, (localhost:3000) but here is part of login component:

 let handleSubmit = (e)=>{
        e.preventDefault()
        axios.post('http://127.0.0.1:8000/login/',login,{withCredential:true},{headers: {'Content-Type': 'application/json','X-CSRFToken':Cookies.get('csrftoken')}}).then(
            (res)=>{
                    console.log(res.data)

            }
    }

I am getting: Forbidden-Csrf token not set on the backend, but when i login from backend 127.0.0.1:8000/login it works fine, and session id is set as https only cookie, csrf is set in cookies, but when i do it from frontend, it gives an error

any idea?