django-csrf

Fixing django csrf error when using uploadify

由 ▼魔方 西西 提交于 2019-12-07 22:59:54
问题 I'm using uploadify in my django admin but I'm getting a 403 error. When I use @csrf_exempt the error is gone but this is very risky. Is there a better way to fix this problem without compromising the admin page by using @csrf_exempt decorator? Thanks in advance 回答1: It sounds like either you or the original author of that package need to update it to work with the changes that have come through in the CSRF framework. Sorry that's not the easy answer... :/ You'll need to make sure the ajax

How to retrieve/provide a CSRF token to/from Django as an API

由 爷，独闯天下 提交于 2019-12-07 06:24:37
问题 I'm working on a project that uses the Django REST Framework as a backend (let's say at api.somecompany.com but has a React.js frontend (at www.somecompany.com ) not served by Django that makes AJAX requests. I can't, therefore, use Django's traditional method of having the template include the CSRF token like this <form action="." method="post">{% csrf_token %} I can make a request to Django REST Framework's api-auth\login\ url, which will return this header: Set-Cookie:csrftoken

Django: POST form requires CSRF? GET doesn't?

由 半城伤御伤魂 提交于 2019-12-07 04:11:48
问题 Are forms that use the POST method required to have CSRF protection? I'm following a book and the code examples throw 403 errors. I did some searching and it seems as if I need to enable CSRF in all my forms. My questions are: Does Django now require that all POST forms be protected from CSRF? All I need to do to accomplish this is add 'django.middleware.csrf.CsrfViewMiddleware', return render_to_response(template,dictionary,context_instance=RequestContext(request), and add '{% csrf_token %}'

Django - Forbidden (CSRF cookie not set.)

由 a 夏天 提交于 2019-12-06 03:12:52
问题 I have a Django web site with medium traffic (about 4000/5000 visits per day). Today I configured the "LOGGING" option on settings.py to send an email with "Info" level, just check if everything was ok... There was my surprise, I am getting the following error: [Django] WARNING (EXTERNAL IP): Forbidden (CSRF cookie not set.) No stack trace available <WSGIRequest path:/cadastro/usuario/, GET:<QueryDict: {}>, POST:<QueryDict: {**xxxxxxx (some varibles....) and**: u'csrfmiddlewaretoken': [u

(Django) CSRF Verification for AJAX requests working in Chrome but not Firefox

由 给你一囗甜甜゛ 提交于 2019-12-05 23:58:01
As the title states, my (Django) CSRF verification is working in Chrome but not Firefox and I'd like to know why so I can fix this. I have this included in the head tag of my base.html file from which all other files in my application extend: base.html, bottom of the head tag <script> $(document).ready(function() { function getCookie(name) { var cookieValue = null; if (document.cookie && document.cookie != '') { var cookies = document.cookie.split(';'); for (var i = 0; i < cookies.length; i++) { var cookie = jQuery.trim(cookies[i]); // Does this cookie string begin with the name we want? if

How to retrieve/provide a CSRF token to/from Django as an API

由 空扰寡人 提交于 2019-12-05 11:23:04
I'm working on a project that uses the Django REST Framework as a backend (let's say at api.somecompany.com but has a React.js frontend (at www.somecompany.com ) not served by Django that makes AJAX requests. I can't, therefore, use Django's traditional method of having the template include the CSRF token like this <form action="." method="post">{% csrf_token %} I can make a request to Django REST Framework's api-auth\login\ url, which will return this header: Set-Cookie:csrftoken=tjQfRZXWW4GtnWfe5fhTYor7uWnAYqhz; expires=Mon, 01-Aug-2016 16:32:10 GMT; Max-Age=31449600; Path=/ - but I can't

CSRF token missing or incorrect. Django + AngularJS

由 泄露秘密 提交于 2019-12-05 08:33:48
I'm getting CSRF token missing or incorrect error while doing a POST request to a remote django api from my localhost machine. My settings on AngularJS: .config(['$httpProvider', function($httpProvider){ $httpProvider.defaults.xsrfCookieName = 'csrftoken'; $httpProvider.defaults.xsrfHeaderName = 'X-CSRFToken'; }]); but im still getting the CSRF token missing or incorrect error. I check what headers are being sent and apparently angular is not sending HTTP_X_CSRFTOKEN . But I can see that the cookie csrftoken=something is sent. Does anyone know what is going on? Request Header POST /s/login/

Django: POST form requires CSRF? GET doesn't?

由 我的梦境 提交于 2019-12-05 06:02:22
Are forms that use the POST method required to have CSRF protection? I'm following a book and the code examples throw 403 errors. I did some searching and it seems as if I need to enable CSRF in all my forms. My questions are: Does Django now require that all POST forms be protected from CSRF? All I need to do to accomplish this is add 'django.middleware.csrf.CsrfViewMiddleware', return render_to_response(template,dictionary,context_instance=RequestContext(request), and add '{% csrf_token %}' in the corresponding form? Am I missing anything here? When I do this, the form works fine. When any

In what case can CSRF-exempt be dangerous?

由 白昼怎懂夜的黑 提交于 2019-12-05 01:33:08
This question is more a re-insurance than one directly about how to code. As an autodidact i did not have a lot of possibilities to ask professionals such things, so i try here. I have read the documents in the django-docs ( https://docs.djangoproject.com/en/1.3/ref/contrib/csrf/ ) and some info on that page: http://cwe.mitre.org/top25/#CWE-352 As far as i have understood, django delivers a token (some kind of pin-code) to a user. And to verify it really is him, he has to return it the next time he does a request. And some guys at Google found out that this is even possible with ajax-requests,

Forbidden (CSRF token missing or incorrect) Django error

由 隐身守侯 提交于 2019-12-05 00:59:06
问题 I am very new to Django. The name of my project is rango and I have created a URL named '/rango/tagger' that is supposed to send an object. In my java-script, I have tried to communicate with this route by sending it an ajax request as follows: function send() { obj = {content:$("#content").val()}; $.post('/rango/tagger',obj,function(data){ console.log(data); }) } I have included the {% csrf_token %} in my template. However, it gives me the error as follows: Forbidden (CSRF token missing or
订阅 django-csrf