登录CSRF验证失败。请求中止

Question

我伸出AbstractBaseUser，我尝试写的登录功能，但我得到这个错误：在views.py

def admin_login(request): 
username = password = '' 
if request.POST: 
    request.session.delete_test_cookie() 
    username = request.POST.get('username') 
    password = request.POST.get('password') 
    admin = Administrator.objects.all.get(username__exact=username) 
    if admin is not None and admin.check_password(password): 
     login(request, admin) 
     request.session['admin_id'] = admin.id 
     return redirect('dashborad') 
return render_to_response('admin/login.html',{ 'username': username}) 

Answer 1

请记住，只要你使用CSRF

CSRF verification failed. Request aborted. 

，你需要将RequestContext的实例传回给视图。另外，您的表单需要添加{% csrf_token %}。

在您的视图代码，你可以使用render shortcut将incude正确的上下文为您提供：

from django.shortcuts import render 

def admin_login(request): 
    # your normal code 
    return render(request, 'admin/login.html', {'username': username}) 

文档的CSRF section有什么，以便需要的清单进行CSRF正常工作。

您还应该使用authenticate()，而不是写你自己的逻辑：

from django.contrib.auth import authenticate 
user = authenticate(username='john', password='secret') 

把所有的一起，你的代码是现在：

from django.shortcuts import render 
from django.contrib.auth import authenticate 
from django.contrib import messages 

def admin_login(request): 
    """Logs in an admin user, redirecting to the dashboard""" 
    if request.POST: 
      username = request.POST.get('username') 
      password = request.POST.get('password') 

      user = authenticate(username, password) 

      if user is not None: 
       if user.is_active: 
        login(request, user) 
        request.session['admin_id'] = user.id 
        return redirect('dashboard') 
       else: 
        # do something because user was not active 
        messages.add_message(request, messages.ERROR, 'User Inactive') 
        return render(request, 'admin/login.html') 
      else: 
       # password/username combination was wrong 
       messages.add_message(request, messages.ERROR, 'Invalid Credentials') 
       return render(request, 'admin/login.html') 
    else: 
     return render(request, 'admin/login.html') 

我使用的是内置messages framework显示错误消息。