Facebook 的帖子“签名请求”中缺少 CSRF 令牌；
我正在处理 Django 项目。目的是从 Facebook 导入用户信息。首先，我使用 Facebook 提供的注册社交插件。我有一个基本模板，其中包括用于注册插件的 iframe；就像 Facebook api 文档建议的那样。呈现此模板的视图如下：
def registration(request):
if (request.method == "POST"):
return HttpResponse("it posted!")
else:
return render_to_response("ui/registration.html", {},
context_instance=RequestContext(request))
当我在插件上按下注册并且 Facebook 向我的视图发送签名请求时，Django 就会抱怨缺少 csrf 令牌。我还尝试通过使用 csrf(request) 在上下文字典中传递 csrf-token 来显式包含 csrf-token，但这仍然不能解决问题。
I am working with a Django project. The aim is to import user information from Facebook. For a start, I am using the registration social plugin that Facebook offers. I have a basic template that includes the iframe for the registration plug-in; just the way the Facebook api documentation suggests. The view that renders this template is as follows:
def registration(request):
if (request.method == "POST"):
return HttpResponse("it posted!")
else:
return render_to_response("ui/registration.html", {},
context_instance=RequestContext(request))
As soon as I press register on the plugin and Facebook sends my view the signed-request, Django complains about the missing csrf token. I also have tried explicitly including the csrf-token by passing it along in the context dictionary using csrf(request), however that still doesn't solve the problem.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
CSRF 保护是为了防止跨站发帖。但是，在这种情况下，您希望接受来自 Facebook 的帖子，因此您应该在接受签名请求的视图上使用
csrf_exempt装饰器。请参阅有关 CSRF 异常的部分： http://docs.djangoproject.com /en/1.3/ref/contrib/csrf/#exceptionsCSRF protection is there to prevent cross-site posts. However, in this case you want to accept the post from Facebook so you should use the
csrf_exemptdecorator on your view which accepts the signed request. See the section on CSRF Exceptions: http://docs.djangoproject.com/en/1.3/ref/contrib/csrf/#exceptions为此，您需要做一些事情：
@csrf_exempt来装饰您的视图，就像 Mark 建议的那样。或者，您可以编写自己的中间件来检查来自 facebook 的 csrf 令牌，而不是执行步骤 2 和 3。
You need to do a few things for this:
@csrf_exempt, like Mark suggested.Alternately, instead of steps 2 and 3 you can write your own middleware to check the csrf tokens coming from facebook.
寻找 fandjango 应用程序，尤其是中间件。
https://github.com/jgorset/fandjango
这对我造成了
look for fandjango app, especially the middleware.
https://github.com/jgorset/fandjango
that did it to me