如何更正 django 中的以下代码，它给出错误“禁止（CSRF 令牌丢失或不正确。）”

Question

<script>
 var CSRF_TOKEN = '{{ csrf_token }}';
    function getQuestion(str)
    {

        if(str!="select subject")
    {
        var req=new XMLHttpRequest();


        req.open("post","/addQuestion/",true);
        str=encodeURIComponent(str);
        req.setRequestHeader("Content-type","application/x-www-form-urlencoded");
        req.send("subject="+str);
        req.onreadystatechange=function()
        {
            if(req.status==200 && req.readyState==4)
            {
                document.getElementById("formdiv").innerHTML=req.responseText;
                document.getElementById("formdiv").style.overflowY="scroll";

            }
        }

    }
    }
</script>

Answer 1

You should set CSRF_TOKEN in request header

req.setRequestHeader('CSRF_TOKEN', CSRF_TOKEN);