csrf攻击与防御

 

/**
 * Created by 95320 on 2018/10/6.
 */
//整个文档都加载完毕后才会执行这个函数
$(function () {
    $('#submit').click(function (event) {
        event.preventDefault();//阻止默认事件
        var email = $('input[name=email]').val();
        var password = $('input[name=password]').val();
        // var csrftoken = $('input[name=csrf_token]').val();
        //从请求头里获取csrftoken
        var csrftoken = $('meta[name=csrf_token]').attr('content');

        //在ajax发送之前设置csrftoken
        $.ajaxSetup({
            'beforeSend': function (xhr,settings) {
                if (!/^(GET|HEAD|OPTIONS|TRACE)$/i.test(settings.type) && !this.crossDomain){
                    xhr.setRequestHeader("X-CSRFToken",csrftoken)
                }
            }

        });

        $.post({
            'url':'/login/',
            'data':{
                'email':email,
                'password':password,
                // 'csrf_token':csrftoken
            },
            'success':function (data) {
                console.log(data);
            },
            'fail':function (error) {
                console.log(error);
            }
        })
    })
});