All geek questions in one place

How to use security_csrf_cookie?

I am new to python. Also new to Django. I am trying to execute an AJAX request and follow the instructions here . At first, the result of restoring the csrf cookie was always null, so I found a decorator method called security_csrf_cookie. The problem is that he is requesting a submission, and I don’t know what kind to transmit, and where I can get a link to it. The code is pretty simple:

from django.shortcuts import render_to_response from django.core.context_processors import csrf from django.views.decorators.csrf import ensure_csrf_cookie def csv_to_xform(csv, template): return render_to_response(template, { "data": "it works!" })

Do I need to use a class based view? if so, is there a better way to set a cookie? I would not want to use the method described here because I do not want to manually process the value.

The rest of the code is as follows:

sandbox.html:

 <!doctype html> <html> <head> <title>Sandbox</title> <script src="http://code.jquery.com/jquery-1.10.1.min.js"></script> <script src="/static/js/csrf.js"></script> <script type="text/javascript"> $(function () { $('#send-csv-btn').click(function () { $.post('/csv', { data: '1, 2, 3', success: function (response) { console.debug(response); }, error: function (response) { console.debug(response); } }); }); }); </script> </head> <body> <form> {% csrf_token %} <input type="button" id="send-csv-btn" /> </form> </body> </html>

urls.py:

 urlpatterns = patterns('', url(r'^$', 'dkobo.formbuilder.views.main', name='fb'), url(r'^admin/', include(admin.site.urls)), url(r'^csv$', 'dkobo.formbuilder.views.csv_to_xform', { "template": "sandbox-stub.html" }), url(r'^sandbox$', 'dkobo.formbuilder.views.sandbox') )

settings.py:

 MIDDLEWARE_CLASSES = ( 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.common.CommonMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', )
+6
source share
4 answers

Cookies collect the server response, so you need to configure the @ensure_csrf_cookie decorator to view, which displays the page from which the user will make an ajax request.

For example, if a user’s browser makes an ajax request on the main page of sites, install this decorator for viewing, which is responsible for the main page.

UPDATE: does ajax request requests from the sandbox page? then try setting the security_csrf_cookie parameter to a sandbox view, for example:

 @ensure_csrf_cookie def sandbox(request): ...
+11
source

For those looking for a way to do this with a class:

 from django.utils.decorators import method_decorator from django.views.decorators.csrf import ensure_csrf_cookie class MyView(View): @method_decorator(ensure_csrf_cookie) def get(self, request, *args, **kwargs): ...
+9
source

Although you find what you are looking for these concepts will help you.

Views are functions that are called when a URL is requested. And there are two types of views:

  • Function Based Views
  • Class based views.

The main browsing job is to process the HttpRequest and send the HttpResponse. And every view returning an HttpResponse should have a request parameter.

Function example:

 def myView(request): ... # process the request here return HttpResponse() # or render_to_response depending upon what you want.

I do not see the request parameter in your view.

Now the decorator is what creates certain conditions for the presentation.

For example: if you have a function for viewing comments and you want the user to be logged in for comments, you can use the login_required decorator on the view.

This ensures that someone who wants to comment must first be logged in. The basic syntax is:

 @login_required # this is the decorator def comment(request): # this is the view on which the decorator is acting upon ... ... return HttpResponse()

Like @login_required, @ensure_csrf_cookie is a decorator.

+3
source

CSRF points are automatically checked if you have:

 MIDDLEWARE_CLASSES = ( ... 'django.middleware.csrf.CsrfViewMiddleware', ... )

in the settings.py project file.

If you have such middleware, you only need to put the crsf_token variable in all your forms (in the templates), and it is automatically checked, for example:

 <form> {% csrf_token %} ...

I do not know if I understood your problem at all;)

+2
source

Source: https://habr.com/ru/post/958563/

More articles:


All Articles