使用 YUI 上传器请求发送 Django CSRF Cookie
我正在尝试使用 YUI 上传器将文件上传到 Django 视图。
但是，我在 CsrfViewMiddleware 中收到 403 错误。我已确定问题是由于 Flash 上传程序（YUI 上传程序使用的）未在文件上传请求中发送 CSRF cookie 造成的。
YUI 上传器的 uploadAll() 函数允许附加数据以对象形式与上传请求一起发送。由于可以轻松检索 CSRF cookie，因此我尝试通过 uploadAll() 函数将 cookie 添加到请求中，但我不完全确定以什么格式发送它，以便 CsrfViewMiddleware 找到它期望的 cookie 。这不起作用：
var cookie = YAHOO.util.Cookie.get('csrftoken'); uploader.uploadAll(url, 'POST', { csrfmiddlewaretoken: cookie });
任何见解将不胜感激！
I am trying to use the YUI uploader to upload files to Django view.
However, I am getting a 403 error in CsrfViewMiddleware. I have determined that the problem is due to the flash uploader (that the YUI uploader uses) not sending the CSRF cookie in the file upload request.
The YUI uploader's uploadAll() function allows additional data to be sent with the upload request in object form. Since the CSRF cookie can be easily retrieved, I am trying to add the cookie to the request via the uploadAll() function, but I am not entirely sure as to what format to send it in so that CsrfViewMiddleware finds the cookie where it expects it. This does not work:
var cookie = YAHOO.util.Cookie.get('csrftoken');
uploader.uploadAll(url, 'POST', { csrfmiddlewaretoken: cookie });
Any insight would be greatly appreciated!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
不幸的是，由于 Flash 播放器的限制，YUI Uploader 无法将 cookie 插入到请求的标头中，而这正是后端所期望的位置。您唯一能做的就是向请求添加 POST 变量，这就是上面的附加参数的作用。然而，这意味着您需要额外的服务器逻辑来将它们提取为 POST 变量，并将它们与 cookie 记录进行比较——默认情况下它不起作用。
如果您无法修改服务器端代码，您将无法验证上传器发送的请求:(。
Unfortunately, because of Flash player limitations, the YUI Uploader can't insert the cookie into the header of the request, which is where the backend expects it to be. The only thing you can do, which is what that additional argument up there does, is to add POST variables to the request. However, that means that you need additional server logic to extract them as POST variables and them compare them to the cookie record -- it won't work by default.
If you are unable to modify the server-side code, you won't be able to authenticate the requests sent from the Uploader :(.