Django CSRF问题
[英]Django CSRF Issues
问题描述
I'm attempting to make a simple login framework for use later on in my site, at the moment its very basic, but I keep being stalled by the Django CSRF protection 
我正在尝试制作一个简单的登录框架，以供稍后在我的网站中使用，目前它是非常基本的，但是我一直被Django CSRF保护所困扰
Steps I have taken: 我已采取的步骤：
MIDDLEWARE_CLASSES = (
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.common.CommonMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.auth.middleware.SessionAuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
'django.middleware.clickjacking.XFrameOptionsMiddleware',
'django.middleware.security.SecurityMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
)
Enabled the CSRFViewMiddleware 启用CSRFViewMiddleware
def request_page(request):
if(request.POST.get('btnLogin')):
if(handleLogin( (request.POST.get('TFUsername')), (request.POST.get('TFPassword')))):
return HttpResponse("yep")
else:
return HttpResponse("nope")
which calls this method in the login handler.py 在登录handler.py中调用此方法
def handleLogin(enteredUsername, enteredPassword):
EvalDBLogin.objects
b = EvalDBLogin(username = enteredUsername,password = enteredPassword)
if b.exists():
return True
else:
return False
The view function does pass a request to the template's render method as shown above view函数确实将请求传递给模板的render方法，如上所示
Every form element contains {% csrf_token %} 每个表单元素都包含{％csrf_token％}
<td width="252"> </td>
<td width="272"><table width="258" height="115" border="0" align="center">
<tr>
<td width="248" height="27"><form id="form1" name="form1" method="post" action="#">{% csrf_token %}
<label for="TFUsername"></label>
<input name="TFUsername" type="text" class="loginBoxes" id="TFUsername" value="username" size="100" maxlength="42" border="5" width="200px"/>
</td>
</tr>
<tr>
<td height="26"><input name="TFPassword" type="password" class="loginBoxes" id="TFPassword" value="password" size="42" maxlength="42" /></td>
</tr>
<tr>
<td height="43">
<input type="submit" name="btnLogin" id="btnLogin" value="Submit" />
</form></td>
</tr>
</table></td>
<td width="252"> </td>
</tr>
</table></td>
Template Context Processors looks as follows: 模板上下文处理器如下所示：
TEMPLATE_CONTEXT_PROCESSORS = (
"django.contrib.auth.context_processors.auth",
"django.core.context_processors.debug",
"django.core.context_processors.i18n",
"django.core.context_processors.media",
"django.core.context_processors.static",
"django.contrib.messages.context_processors.messages",
"LoginSystem",
)
Am I missing something, or is it a technical problem my end? 我是否缺少某些东西，还是我的技术难题？
Issue shown : http://puu.sh/jsRQh/384a552b2e.png 显示的问题： http : //puu.sh/jsRQh/384a552b2e.png
I know there are a few questions already on SO regarding this, but I couldn't quite find one that fully answered my question. 我知道已经有一些关于此的问题，但是我找不到完全能够回答我问题的问题。
As a side note, the same error is returned if i exempt the method below from csrf 附带说明一下，如果我从csrf中豁免以下方法，则会返回相同的错误
Help is greatly appreciated! 非常感谢您的帮助！
rendered Html: 呈现的HTML：
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Login</title>
<style type="text/css">
.loginBoxes {
font-family: "Comic Sans MS", cursive;
font-size: 14px;
color: #AFAFAF;
background-color: #F8F8F8;
text-align: center;
width: auto;
}
#TFUsername {
border-radius: 15px 50px;
padding: 20px;
width: 300px;
height: 20px;
}
#TFPassword {
border-radius: 15px 50px;
padding: 20px;
width: 300px;
height: 20px;
}
#btnLogin{
border-radius: 25px;
background: #0066FF;
display: table-cell;
width: 310px;
display:table-cell;
margin:auto;
display:block;
height: 31px;
}
</style>
</head>
<body>
<table width="800" height="722" border="0" align="center">
<tr>
</tr>
<tr>
<td><table width="800" height="253" border="0" align="center">
<tr>
<td width="252"> </td>
<td width="272"><table width="258" height="115" border="0" align="center">
<tr>
<td width="248" height="27"><form id="form1" name="form1" method="post" action="#">
<label for="TFUsername"></label>
<input name="TFUsername" type="text" class="loginBoxes" id="TFUsername" value="username" size="100" maxlength="42" border="5" width="200px"/>
</td>
</tr>
<tr>
<td height="26"><input name="TFPassword" type="password" class="loginBoxes" id="TFPassword" value="password" size="42" maxlength="42" /></td>
</tr>
<tr>
<td height="43">
<input type="submit" name="btnLogin" id="btnLogin" value="Submit" />
</form></td>
</tr>
</table></td>
<td width="252"> </td>
</tr>
</table></td>
</tr>
<tr>
<td> </td>
</tr>
</table>
</body>
</html>
Rendering of Template 模板渲染
def index(request):
template = loader.get_template('loginSystem/index.html')
return HttpResponse(template.render())
1 个解决方案
解决方案1
3 已采纳 2015-08-07 15:36:13
You have included the csrf middleware twice. 您已经两次包含了csrf中间件。 You can remove it the second time. 您可以第二次将其删除。
'django.middleware.csrf.CsrfViewMiddleware',
You can remove the csrf_protect decorator, since you are using the middleware, all views will be protected by default. 您可以删除csrf_protect装饰器，因为您使用的是中间件，因此默认情况下所有视图都将受到保护。
Since you are using RequestContext , you can remove "django.core.context_processors.csrf" from your template context processors, since it's always included. 由于您使用的是RequestContext ，因此可以始终从模板上下文处理器中删除"django.core.context_processors.csrf" 。
The request context should be the third argument to render_to_response , not the second: 请求上下文应该是render_to_response的第三个参数，而不是第二个：
return render_to_response('loginSystem/index1.html', {}, csrfContext)
But you'd be better to use the render shortcut instead, then you don't need a request context at all. 但是最好改用render快捷方式，这样就根本不需要请求上下文。
from django.shortcuts import render
return render(request, 'loginSystem/index1.html')
If it still doesn't work after making those changes, please update your question above, and include what the post what the rendered template looks like. 如果进行了这些更改后仍然无法正常运行，请在上方更新您的问题，并在帖子中提供呈现的模板的外观。
声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.