授权时CSRF验证失败

Question

When I'm trying to authorize by

curl -X POST -d "grant_type=password&username=myusername&password=mypassword" http://localhost:8000/oauth2/authorize/

I get 403 forbidden: CSRF validation failed. Request aborted. I can't understand why, any help would be appreciated.

By the way I use Django OAuth Toolkit for authentication.

Edit: I know about CSRF protection and how to use it in django view and forms, I'm using a package called Django OAuth Toolkit for oauth 2 authorization which shouldn't ask for csrf token. There is a little information here about what I'm tring to achieve.

Answer 1

我很to愧地说我将请求发送到错误的URL，我应该将其发送到http://localhost:8000/oauth2/token/

curl -X POST -d "grant_type=password&username=myusername&password=mypassword&client_id=myclientid"  http://localhost:8000/oauth2/token/

Answer 2

You need to add csrf token in your POST data.

https://docs.djangoproject.com/en/dev/ref/contrib/csrf/

Answer 3

It's probably worth your while reading the documentation on Django's built in Cross Site Request Forgery protection .

Any post to a Django view will need the csrfmiddlewaretoken set, otherwise you'll get a 403. You'll need to either include it, or exempt your view from CSRF protection (prefer the former approach if possible).