CSRF使用Ajax轮询

Question

我有一些AJAX来轮询每5秒服务器：

var date = $('article').first().find('time').text(); 
console.log(date); 

setInterval(function() { 
    $.post('pollNewEntries', {'date':date}, newEntrySuccess) 
}, 5000); 

不幸的是，我每次AJAX尝试轮询服务器时得到一个403错误，说明我已经无效的CSRF请求。我之前使用过AJAX，并且在表单中包含了CSRF标记，但是我不确定我会如何处理上述的无格式AJAX请求。

Answer 1

对这个问题的解决方案是Django文档中描述：https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#ajax

此代码添加到您的js的顶部：

$.ajaxSetup({ 
    beforeSend: function(xhr, settings) { 
     function getCookie(name) { 
      var cookieValue = null; 
      if (document.cookie && document.cookie != '') { 
       var cookies = document.cookie.split(';'); 
       for (var i = 0; i < cookies.length; i++) { 
        var cookie = jQuery.trim(cookies[i]); 
        // Does this cookie string begin with the name we want? 
        if (cookie.substring(0, name.length + 1) == (name + '=')) { 
         cookieValue = decodeURIComponent(cookie.substring(name.length + 1)); 
         break; 
        } 
       } 
      } 
      return cookieValue; 
     } 
     if (!(/^http:.*/.test(settings.url) || /^https:.*/.test(settings.url))) { 
      // Only send the token to relative URLs i.e. locally. 
      xhr.setRequestHeader("X-CSRFToken", getCookie('csrftoken')); 
     } 
    } 
}); 

Answer 2

您需要将csrf标记与您的帖子一起传递数据：

var date = $('article').first().find('time').text(); 
console.log(date); 

setInterval(function() { 
    $.post('pollNewEntries', {'date':date, 'csrfmiddlewaretoken': '{{csrf_token}}'}, newEntrySuccess) 
}, 5000);