CSRF

1. CSRF
	a. 基本应用
		form表单中添加  先发给用户 用户带着值提交表单 github
		{% csrf_token %} #生成隐藏的input框 {{csrf_token}} #生成随机字符串
		cookie 也会有csrf_token
	
	b. 全站禁用
		# 'django.middleware.csrf.CsrfViewMiddleware',
	
	c. 局部禁用
		'django.middleware.csrf.CsrfViewMiddleware',
		
		from django.views.decorators.csrf import csrf_exempt

		@csrf_exempt
		def csrf1(request):

			if request.method == 'GET':
				return render(request,'csrf1.html')
			else:
				return HttpResponse('ok')
	d. 局部使用
		# 'django.middleware.csrf.CsrfViewMiddleware',
		
		from django.views.decorators.csrf import csrf_exempt,csrf_protect

		@csrf_protect
		def csrf1(request):

			if request.method == 'GET':
				return render(request,'csrf1.html')
			else:
				return HttpResponse('ok')
	
	c. 特殊CBV
			from django.views import View
			from django.utils.decorators import method_decorator
			
			@method_decorator(csrf_protect,name='dispatch')
			class Foo(View):
				
				def get(self,request):
					pass

				def post(self,request):
					pass
	
	PS：CBV中添加装饰器
		def wrapper(func):
			def inner(*args,**kwargs):
				return func(*args,**kwargs)
			return inner
		# 1. 指定方法上添加装饰器

			# class Foo(View):
			#
			#     @method_decorator(wrapper)
			#     def get(self,request):
			#         pass
			#
			#     def post(self,request):
			#         pass
		# 2. 在类上添加
			#     @method_decorator(wrapper,name='dispatch')
			#     class Foo(View):
			#
			#         def get(self,request):
			#             pass
			#
			#         def post(self,request):
			#             pass
		
	
	Ajax提交数据时候，携带CSRF：
		a. 放置在data中携带
		
			<form method="POST" action="/csrf1.html">
				{% csrf_token %}
				<input id="user" type="text" name="user" />
				<input type="submit" value="提交"/>
				<a onclick="submitForm();">Ajax提交</a>
			</form>
			<script src="/static/jquery-1.12.4.js"></script>
			<script>
				function submitForm(){
					var csrf = $('input[name="csrfmiddlewaretoken"]').val();
					var user = $('#user').val();
					$.ajax({
						url: '/csrf1.html',
						type: 'POST',
						data: { "user":user,'csrfmiddlewaretoken': csrf},
						success:function(arg){
							console.log(arg);
						}
					})
				}

			</script>
			
		b. 放在请求头中 $.cookie('csrftoken') 获取token $.cookie('csrftoken','jsjs') 设置token
		
				<form method="POST" action="/csrf1.html">
					{% csrf_token %}
					<input id="user" type="text" name="user" />
					<input type="submit" value="提交"/>
					<a onclick="submitForm();">Ajax提交</a>
				</form>
				<script src="/static/jquery-1.12.4.js"></script>
				<script src="/static/jquery.cookie.js"></script>

				<script>
					function submitForm(){
						var token = $.cookie('csrftoken');
						var user = $('#user').val();
						$.ajax({
							url: '/csrf1.html',
							type: 'POST',
							headers:{'X-CSRFToken': token},
							data: { "user":user},
							success:function(arg){
								console.log(arg);
							}
						})
					}
				</script>
		c.

			<form method="POST" action="/csrf1.html">
					{% csrf_token %}
					<input id="user" type="text" name="user" />
					<input type="submit" value="提交"/>
					<a onclick="submitForm();">Ajax提交</a>
				</form>
				<script src="/static/jquery-1.12.4.js"></script>
				<script src="/static/jquery.cookie.js"></script>

				<script>
					function submitForm(){
						$.ajax({
							url: '/csrf1.html',
							type: 'POST',
							data: { "user":user,"csrfmiddlewaretoken":'{{csrf_token}}'},
							success:function(arg){
								console.log(arg);
							}
						})
					}
				</script>