CSRF与Ajax和Django的职位职位、CSRF、Ajax、Django

2023-09-10 17:40:09 作者:傲世猖狂

使用jquery1.7.1和django1.3,我试图让通过AJAX POST请求,在一些教程code我发现的网络

Using jquery1.7.1 and django1.3 ,I was trying to make a post request through ajax,in some tutorial code I found on web

$(document).ready(function(){
    $("#create").click(create_note);

});

var create_note = function() {
  var title = $("#title").val()
  var slug = $("#slug").val()
  if (title != "" && slug != "") {
    var data = { title:title, slug:slug };
    console.log('title='+title);
    console.log('slug='+slug);
    var args = { type:"POST", url:"/create/", data:data, complete:done };
    $.ajax(args);
  }
  else {
    // display failure
  }
  return false;
};

网址/新建/映射到Django的观点

The url "/create/" is mapped to django view

(r'^create/$','notes.views.create_note'),

def create_note(request):
    error_msg = u"No POST data sent."
    if request.method == "POST":
        post = request.POST.copy()
        if post.has_key('slug') and post.has_key('title'):
            slug = post['slug']
            if Note.objects.filter(slug=slug).count() > 0:
                error_msg = u"Slug already in use."
            else:
                title = post['title']
                new_note = Note.objects.create(title=title,slug=slug)
                return HttpResponseRedirect(new_note.get_absolute_url())
        else:
            error_msg = u"Insufficient POST data (need 'slug' and 'title'!)"
    return HttpResponseServerError(error_msg)

当我点击提交按钮,这将触发JavaScript函数 create_note ,我得到一个403错误。必须是跨站请求伪造问题。

When I click the submit button,which triggers the javascript function create_note ,I get a 403 error. Must be the csrf problem..

我试图通过修改现成的功能来解决这个

I tried to solve this by modifying the ready function

$(document).ready(function(){
        $.ajaxSetup({
        data: {csrfmiddlewaretoken: '{{ csrf_token }}' },
    });
        $("#create").click(create_note);

    });

但它没有work..I仍然获得 403错误

所以,我试图修改 AJAX 调用数据。

So,I tried to modify the data in ajax call

var create_note = function() {
    var data = { title:title, slug:slug ,csrfmiddlewaretoken: '{{ csrf_token }}'};
    ...
    var args = { type:"POST", url:"/create/", data:data, complete:done };
    $.ajax(args);

};

不过它会导致403错误。

Still it causes 403 error..

请告诉我应该做些什么来纠正this..I看到了 这个 Django的文档,但我很困惑如何使使用that.Should我复制整个 jQuery的(文件).ajaxSend(... code。在我的javascript file..I我真的很困惑在这里..

Please tell me what should be done to correct this..I saw the django doc about this,but I am confused how to make use of that.Should I copy the entire jQuery(document).ajaxSend(... code in to my javascript file..I am really confused here..

推荐答案

您需要(的为您链接的文件,建议)复制整个 ajaxSend 方法...

You need to (as the document you linked to suggests) copy that entire ajaxSend method ...

您不需要对其进行修改以任何方式 - 这是一个完整的解决方案 - ajaxSend 方法实际上是一个事件处理程序 ajaxSend 事件。它在使用jQuery中阿贾克斯方法所触发。 这里见ajaxSend文档

You dont need to modify it in any way - it is a complete solution - the ajaxSend method is actually an event handler for the ajaxSend event. Its triggered when you use the .ajax method in jQuery. See the ajaxSend docs here

在上面的文件链接的方法追加了正确的 X-CSRFToken 头到你的AJAX请求。然后,您可以使用第一种方法来发送Ajax请求。

The method linked in the above document appends the correct X-CSRFToken header to your AJAX request. You can then use your first method for sending the AJAX request.

 
精彩推荐
图片推荐