маркер ошибка CSRF во время запроса JSON по запросу после

Question

Я пытаюсь сделать ответ JSon по запросу поста от Джанго таким образом, что моя точка зрения является

from django.shortcuts import render 
from django.http import HttpResponse 
from django.views.generic import View 

class TaskView(View): 
    def get(self,request,*args,**kwargs): 
     return HttpResponse("hello",content_type="application/json") 
    def post(self,request,*args,**kwargs): 
     return HttpResponse("hello",content_type="application/json") 

это должно вернуть ответ привета JSon как для получения, а также как почтовый запрос.

Но я получаю запрос на это, он работает. Но если я сделать пост запрос, то я получаю следующую ошибку

Forbidden (403) 
CSRF verification failed. Request aborted. 
You are seeing this message because this HTTPS site requires a 'Referer header' to be sent by your Web browser, but none was sent. This header is required for security reasons, to ensure that your browser is not being hijacked by third parties. 
If you have configured your browser to disable 'Referer' headers, please re-enable them, at least for this site, or for HTTPS connections, or for 'same-origin' requests. 
Help 
Reason given for failure: 
    Referer checking failed - no Referer. 

In general, this can occur when there is a genuine Cross Site Request Forgery, or when Django's CSRF mechanism has not been used correctly. For POST forms, you need to ensure: 
Your browser is accepting cookies. 
The view function uses RequestContext for the template, instead of Context. 
In the template, there is a {% csrf_token %} template tag inside each POST form that targets an internal URL. 
If you are not using CsrfViewMiddleware, then you must use csrf_protect on any views that use the csrf_token template tag, as well as those that accept the POST data. 
You're seeing the help section of this page because you have DEBUG = True in your Django settings file. Change that to False, and only the initial error message will be displayed. 
You can customize this page using the CSRF_FAILURE_VIEW setting. 

Мой промежуточного слоя настройки

MIDDLEWARE_CLASSES = (
    'django.contrib.sessions.middleware.SessionMiddleware', 
    'django.middleware.common.CommonMiddleware', 
    'django.middleware.csrf.CsrfViewMiddleware', 
    'django.contrib.auth.middleware.AuthenticationMiddleware', 
    'django.contrib.auth.middleware.SessionAuthenticationMiddleware', 
    'django.contrib.messages.middleware.MessageMiddleware', 
    'django.middleware.clickjacking.XFrameOptionsMiddleware', 
) 

мне нужно реорганизовать любую часть обзора для обработки после запроса на JSON класса.

Answer 1

Вам необходимо осуществить явную защиту CSRF в запросе:

// using jQuery 
function getCookie(name) { 
    var cookieValue = null; 
    if (document.cookie && document.cookie != '') { 
     var cookies = document.cookie.split(';'); 
     for (var i = 0; i < cookies.length; i++) { 
      var cookie = jQuery.trim(cookies[i]); 
      // Does this cookie string begin with the name we want? 
      if (cookie.substring(0, name.length + 1) == (name + '=')) { 
       cookieValue = decodeURIComponent(cookie.substring(name.length + 1)); 
       break; 
      } 
     } 
    } 
    return cookieValue; 
} 
var csrftoken = getCookie('csrftoken'); 

function csrfSafeMethod(method) { 
    // these HTTP methods do not require CSRF protection 
    return (/^(GET|HEAD|OPTIONS|TRACE)$/.test(method)); 
} 

function sameOrigin(url) { 
    // test that a given url is a same-origin URL 
    // url could be relative or scheme relative or absolute 
    var host = document.location.host; // host + port 
    var protocol = document.location.protocol; 
    var sr_origin = '//' + host; 
    var origin = protocol + sr_origin; 
    // Allow absolute or scheme relative URLs to same origin 
    return (url == origin || url.slice(0, origin.length + 1) == origin + '/') || 
     (url == sr_origin || url.slice(0, sr_origin.length + 1) == sr_origin + '/') || 
    // or any other URL that isn't scheme relative or absolute i.e relative. 
    !(/^(\/\/|http:|https:).*/.test(url)); 
} 
$.ajaxSetup({ 
    beforeSend: function(xhr, settings) { 
     if (!csrfSafeMethod(settings.type) && !this.crossDomain) { 
      xhr.setRequestHeader("X-CSRFToken", csrftoken); 
     } 
    } 
}); 

См: Cross Site Request Forgery protection

Answer 2

Если вы используете форму submit или ajax для вызова POST. вам необходимо передать {{csrf_token}} вместе с отправкой формы.

вы можете поделиться код шаблона ..