#27396: Docs: send POST request on base.html does not mention {{ csrf_toeken }}
-------------------------------------+-------------------------------------
Reporter: Ramin Farajpour | Owner: nobody
Cami |
Type: | Status: new
Cleanup/optimization |
Component: Documentation | Version: 1.10
Severity: Normal | Resolution:
Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Ramin Farajpour Cami):
Replying to [comment:2 Ramin Farajpour Cami]:
> Replying to [comment:1 Aymeric Augustin]:
> > It's unclear to me how declaring this `<meta>` tag causes the CSRF
token to be added to AJAX requests.
> >
> > Are you using JavaScript code to extract it from there and add it to
AJAX requests?
> >
> > Or is this a behavior of `<meta>` tags that I'm not familiar with?
> >
> > If the latter, is it a standardized behavior across browsers? Can you
provide a like to documentation or compatibility tables?
>
> Hi ,
>
> please look this ,
>
> http://api.rubyonrails.org/classes/ActionView/Helpers/CsrfHelper.html
>
> 1 - go to http://www.bugjoo.ir/ first if you use chrome plz press
(ctrl+shift+n)
> 2- you see render error
> 3- please sniff request AJAX (session/current)
>
> you see like this,
>
> {{{
>
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
> Accept-Encoding:gzip, deflate, sdch
> Accept-Language:en-US,en;q=0.8
> Cache-Control:no-cache
> Connection:keep-alive
> Cookie:__cfduid=d1b7d99024046b0a11e455b195c55783e1477636721
> Host:www.bugjoo.ir
> Pragma:no-cache
> Upgrade-Insecure-Requests:1
> User-Agent:Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36
> }}}
>
> there isn't `csrf_token` on cookie,
--
Ticket URL: <https://code.djangoproject.com/ticket/27396#comment:3>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/065.a674cdd20c3af8efc74c2177f95818a3%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
