标签：headers war var code 应用 doctype post 按钮 UI
一、简介
django为用户实现防止跨站请求伪造的功能，通过中间件django.middleware.csrf.CsrfViewMiddleware来完成。而对于django中设置防跨站请求伪造功能有分为全局和局部。
全局：
中间件 django.middleware.csrf.CsrfViewMiddleware
局部：
@csrf_protect,为当前函数强制设置防跨站请求伪造功能，即便settings中没有设置全局中间件。
@csrf_exempt,取消当前函数防跨站请求伪造功能，即便settings中设置了全局中间件。
注：from django.views.decorators.csrf import csrf_exempt,csrf_protect
二、应用
1.form表单
<form action="/login/" method="POST"> {% csrf_token %} <input type="text" name="user"/> <input type="password" name="pwd"/> <input type="checkbox" name="rmb" value="1"> 10秒免登录 <input type="submit" name="提交"/> </form>
2.Ajax
（1）给某个ajax单独添加
1 <!DOCTYPE html> 2 <html lang="en"> 3 <head> 4 <meta charset="UTF-8"> 5 <title>Title</title> 6 </head> 7 <body> 8 <form action="/login/" method="POST"> 9 {% csrf_token %} 10 <input type="text" name="user"/> 11 <input type="password" name="pwd"/> 12 <input type="checkbox" name="rmb" value="1"> 10秒免登录 13 <input type="submit" name="提交"/> 14 <input id="btn1" type="button" value="按钮"/> 15 <input id="btn2" type="button" value="按钮"/> 16 </form> 17 <script src="/static/jquery-1.12.4.js"></script> 18 <script src="/static/jquery.cookie.js"></script> 19 <script> 20 $(function () { 21 $("#btn1").click(function () { 22 $.ajax({ 23 url: "/login/", 24 type: "POST", 25 data: {"user": "root", "pwd": "123"}, 26 headers: {"X-CSRFtoken": $.cookie("csrftoken")}, 27 success: function (arg) { 28 29 } 30 }); 31 }); 32 33 }); 34 </script> 35 </body> 36 </html>
（2）给所有ajax添加
1 <!DOCTYPE html> 2 <html lang="en"> 3 <head> 4 <meta charset="UTF-8"> 5 <title>Title</title> 6 </head> 7 <body> 8 <form action="/login/" method="POST"> 9 {% csrf_token %} 10 <input type="text" name="user"/> 11 <input type="password" name="pwd"/> 12 <input type="checkbox" name="rmb" value="1"> 10秒免登录 13 <input type="submit" name="提交"/> 14 <input id="btn1" type="button" value="按钮"/> 15 <input id="btn2" type="button" value="按钮"/> 16 </form> 17 <script src="/static/jquery-1.12.4.js"></script> 18 <script src="/static/jquery.cookie.js"></script> 19 <script> 20 $(function () { 21 {# XMLHttpRequest#} 22 $.ajaxSetup({ 23 beforeSend: function (xhr, settings) { 24 xhr.setRequestHeader("X-CSRFtoken", $.cookie("csrftoken")); 25 } 26 }); 27 28 $("#btn1").click(function () { 29 $.ajax({ 30 url: "/login/", 31 type: "POST", 32 data: {"user": "root", "pwd": "123"}, 33 {# headers: {"X-CSRFtoken": $.cookie("csrftoken")},#} 34 success: function (arg) { 35 36 } 37 }); 38 }); 39 40 $("#btn2").click(function () { 41 $.ajax({ 42 url: "/login/", 43 type: "POST", 44 data: {"user": "root", "pwd": "123"}, 45 {# headers: {"X-CSRFtoken": $.cookie("csrftoken")},#} 46 success: function (arg) { 47 48 } 49 }); 50 }); 51 }); 52 </script> 53 </body> 54 </html>
三、官方示例
<!DOCTYPE html> <html> <head lang="en"> <meta charset="UTF-8"> <title></title> </head> <body> {% csrf_token %} <input type="button" onclick="Do();" value="Do it"/> <script src="/static/plugin/jquery/jquery-1.8.0.js"></script> <script src="/static/plugin/jquery/jquery.cookie.js"></script> <script type="text/javascript"> var csrftoken = $.cookie(‘csrftoken‘); function csrfSafeMethod(method) { // these HTTP methods do not require CSRF protection return (/^(GET|HEAD|OPTIONS|TRACE)$/.test(method)); } $.ajaxSetup({ beforeSend: function(xhr, settings) { if (!csrfSafeMethod(settings.type) && !this.crossDomain) { xhr.setRequestHeader("X-CSRFToken", csrftoken); } } }); function Do(){ $.ajax({ url:"/app01/test/", data:{id:1}, type:‘POST‘, success:function(data){ console.log(data); } }); } </script> </body> </html>
标签：headers war var code 应用 doctype post 按钮 UI
原文地址：http://www.cnblogs.com/qiang8216/p/6945441.html
