#27396: Docs: send POST request on base.html does not mention {{ csrf_toeken }}
--------------------------------------+--------------------
Reporter: Ramin Farajpour Cami | Owner: nobody
Type: Cleanup/optimization | Status: new
Component: Documentation | Version: 1.10
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------------+--------------------
Hi,
Have a look at the section "AJAX " in this documentation page:
https://docs.djangoproject.com/en/1.10/ref/csrf/#ajax
It does not mention the highly relevantcsrf_toeken on meta tag on
base.html I think it should.
{{{
<meta content="{{ csrf_token }}" name='csrfmiddlewaretoken' />
}}}
many case there is use AJAX on root path `http://127.0.0.1` this action
urls.py:
{{{
url(r'^$', Index , name='Index'),
}}}
base.html
{{{
<!DOCTYPE html>
<html lang="en">
<head>
<link rel="stylesheet" href="style.css" />
<title>{% block title %}My amazing site{% endblock %}</title>
</head>
<body>
<div id="sidebar">
{% block sidebar %}
<ul>
<li><a href="/">Home</a></li>
<li><a href="/blog/">Blog</a></li>
</ul>
{% endblock %}
</div>
<div id="content">
{% block content %}{% endblock %}
</div>
</body>
</html>
}}}
index.html
{{{
{% extends "base.html" %}
{% block title %}{{ section.title }}{% endblock %}
{% block content %}
<h1>{{ section.title }}</h1>
{% endblock %}
}}}
now when action index return render , now if users use AJAX on base.html
(for example : check session permission on use javascript on page
base.html ) howevery this page nothing cookie set csrf_token for send to
server side ,
there is 2 way :
1 - use {% csrf_token %} , this create input tag on base.html (this is
not good )
2 - use meta tag (`<meta content="{{ csrf_token }}"
name='csrfmiddlewaretoken' />`)
i use 2 , and work it great ,
--
Ticket URL: <https://code.djangoproject.com/ticket/27396>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/050.df5d2241e3b2d20feb2768c45832d909%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
