Forbidden (403) CSRF verification failed. Request aborted.

标签：

Forbidden (403)
CSRF verification failed. Request aborted.
You are seeing this message because this site requires a CSRF cookie when submitting forms. This cookie is required for security reasons, to ensure that your browser is not being hijacked by third parties.
If you have configured your browser to disable cookies, please re-enable them, at least for this site, or for ‘same-origin‘ requests.
Help
Reason given for failure:
CSRF cookie not set.

In general, this can occur when there is a genuine Cross Site Request Forgery, or when Django‘s CSRF mechanism has not been used correctly. For POST forms, you need to ensure:
Your browser is accepting cookies.
The view function passes a request to the template‘s render method.
In the template, there is a {% csrf_token %} template tag inside each POST form that targets an internal URL.
If you are not using CsrfViewMiddleware, then you must use csrf_protect on any views that use the csrf_token template tag, as well as those that accept the POST data.
You‘re seeing the help section of this page because you have DEBUG = True in your Django settings file. Change that to False, and only the initial error message will be displayed.
You can customize this page using the CSRF_FAILURE_VIEW setting.

被折腾很久，最终解决是参考http://blog.csdn.net/middlekingt/article/details/8593031 里面添加了装饰器好了。

但是问题依旧，后来又看到另外一种方式在这个网站上：
o manually exclude a view function from being handled by either of the two CSRFmiddleware, you can use the csrf_exempt decorator, found in thedjango.views.decorators.csrf module. For example:
from django.views.decorators.csrf import csrf_exempt

@csrf_exempt
def my_view(request):
    return HttpResponse(‘Hello world‘)
Like the middleware, the csrf_exempt decorator is composed of two parts: acsrf_view_exempt decorator and a csrf_response_exempt decorator, foundin the same module. These disable the view protection mechanism(CsrfViewMiddleware) and the response post-processing(CsrfResponseMiddleware) respectively. They can be used individually ifrequired.
终于把这个问题解决了。

其实我是绕开了这个问题，因为django之所以引进CSRF是为了避免Cross Site Request Forgeries攻击，而上面的解决方法恰好禁止掉这个django的功能。所以日后还得仔细研究下，在不禁掉这个功能的前提下成功的提交表单。

Forbidden (403) CSRF verification failed. Request aborted.

标签：

原文地址：http://www.cnblogs.com/gjwork/p/4648124.html