使用REST API时如何获取CSRF令牌并将其包含在标头中

Question

我正在使用python Django创建REST API。客户端是在react中开发的，并且是独立的应用程序。我使用axios来触发http请求。我需要在每个post请求中传递CSRF令牌，但不是能够从浏览器获取CSRF令牌。

Answer 1

How to pass your CSRF when doing Ajax request?

First, make sure you have the django.middleware.csrf.CsrfViewMiddleware in your middlewares list in your settings file. This middleware sets the CSRF_TOKEN in the cookie so you can retrieve it for your ajax request.

Second, Django can now store the CSRF in the session. However, in your particular case you don't want the CSRF_TOKEN in the session. Make sure you have CSRF_USE_SESSIONS = False (which is the default) to have the CSRF in the cookie.

If you check the cookies you should now have a CSRF_TOKEN in there. You can add it dynamically to your ajax request IF you are using jquery with the following code.

https://docs.djangoproject.com/en/1.11/ref/csrf/#setting-the-token-on-the-ajax-request

I'm saying IF you use Jquery because you are using React, which doesn't need Jquery to do Ajax request, it's up to you how you do them.