睡衣 +姜戈 => CSRF混乱，403错误
我已经在 Windows 7 上使用 mod_wsgi 通过 Apache2 运行 Pyjamas 和 Django。不过，我不相信我会从这些东西的设置中遇到问题：唯一不起作用的是尝试从 Pyjamas 生成的 POST 信息形式。尝试在我的应用程序中使用 Pyjamas 生成的表单会产生 403（“CSRF 验证失败”错误页面）。
我花了几个小时在这个问题上，阅读了我可以在这里找到的所有与 CSRF 和 Pyjamas 相关的答案，并且对 CSRF 和 Django、Django 和 Ajax 等进行了大量的外部研究。如果这个问题没有到达任何人的手中谁知道在这种情况下该怎么做，我想我已经简化了问题的本质。
如何将 {% csrf_token %} 获取到 Pyjamas 生成的表单中？这似乎是不可能的，因为据我了解，CSRF 令牌不是持久的，Pyjamas 生成的页面是......我的 Pyjamas 页面是从 Pyjamas .py 文件生成的，导致一个充满硬编码内容的文件夹。我如何将当前的 CSRF 令牌集成到已经编码的表单中？
请随时询问更多详细信息，这个问题非常难以解决。没有任何关于整合睡衣和睡衣的公开信息。姜戈重视这一点；我发现的唯一解决方案似乎意识到 Django 中的 CSRF 说你应该禁用 CSRF 保护（我可以这样做，但是我可以用什么保护来代替它？我自己的 cookie无论如何，禁用 CSRF 保护是一个糟糕的主意吗？）。
谢谢你！
I've got Pyjamas and Django running via Apache2 with mod_wsgi on Windows 7. I do not believe I'm getting issues from the setups of these things, though: the only thing that is not working is trying to POST information from Pyjamas-generated forms. Trying to use Pyjamas-generated forms in my application produces 403s (the "CSRF verification failed" error page).
I have spent hours on this and read all of the answers I could find on here related to CSRF and Pyjamas, and done a lot of external research just on CSRF and Django, Django and Ajax, etc. If this question isn't reaching anyone who has knows just what to do in this situation, I think I've whittled down the essence of the question.
How would one get the {% csrf_token %} into the Pyjamas-generated form? It seems like it might be impossible, because from what I understand CSRF tokens are not persistent, which a Pyjamas-generated page is ... My Pyjamas page is generated from a Pyjamas .py file, resulting in a folder full of hard-coded stuff. How is it that I would integrate the current CSRF token into that already-coded form?
Please don't hesitate to ask for more details, this issue has been incredibly hard to navigate. None of the published information on integrating Pyjamas & Django regards this; and the only solutions I've found that seem aware of CSRF in Django say you should probably just disable CSRF protection (which I could do, but what protection could I put in place of it? My own cookie system? Is it a terrible idea to disable CSRF protection in any case?).
Thank you!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您需要编写一些 JavaScript 来从 cookie（HTTP 请求的一部分）获取 CSRF 令牌，然后在提交时将其添加到表单中。
查看这个答案作为起点： Django CSRF check failed with Ajax POST 请求
这里的关键是 JavaScript 可以像 Pyjamas 生成的文件一样持久，因为它们推迟处理令牌，直到提交表单。
You'll need to write some JavaScript to get the CSRF token from the cookie (part of the HTTP request), then add it to the form on submit.
Look at this answer for a starting point: Django CSRF check failing with an Ajax POST request
The key here is that the JavaScript can be as persistent as your Pyjamas-generated files, because they defer handling the token until the form is submitted.