cookie 中沒有csfrtoken的解決辦法

https://www.jianshu.com/p/9346bbc3a8f1

http://www.mamicode.com/info-detail-2062660.html

通常咱們認爲cookie裏的csrftoken是由csrftoken middleware所設置的，事實確實如此，但也不徹底是。貼一段CsrfViewMiddleware的代碼：

def process_response(self, request, response): if getattr(response, 'csrf_processing_done', False): return response # If CSRF_COOKIE is unset, then CsrfViewMiddleware.process_view was # never called, probably because a request middleware returned a response # (for example, contrib.auth redirecting to a login page). if request.META.get("CSRF_COOKIE") is None: return response # 重點在這裏 if not request.META.get("CSRF_COOKIE_USED", False): return response # Set the CSRF cookie even if it's already set, so we renew # the expiry timer. response.set_cookie(settings.CSRF_COOKIE_NAME, request.META["CSRF_COOKIE"], max_age=settings.CSRF_COOKIE_AGE, domain=settings.CSRF_COOKIE_DOMAIN, path=settings.CSRF_COOKIE_PATH, secure=settings.CSRF_COOKIE_SECURE, httponly=settings.CSRF_COOKIE_HTTPONLY ) # Content varies with the CSRF cookie, so set the Vary header. patch_vary_headers(response, ('Cookie',)) response.csrf_processing_done = True return response 

這段代碼的重點在於對CSRF_COOKIE_USED的檢查，若是沒有設置，middleware會直接返回response而不在cookie裏設置csrftoken。
而CSRF_COOKIE_USED是在哪設置的呢？有幾種途徑：

1. 1. 手動設置，在view 中添加 

   request.META["CSRF_COOKIE_USED"] = True

   2. 手動調用 csrf 中的 get_token(request) 或 rotate_token(request) 方法。

   from django.middleware.csrf import get_token ,rotate_token
   
   def server(request):
   
       # get_token(request)       // 二者選一
       # rotate_token(request)   // 此方法每次設置新的cookies
   
       return render(request, ‘server.html‘)

   3. 在HTML模板中添加 {% csrf_token %}

   4. 在須要設置cookie的視圖上加裝飾器 ensure_csrf_cookie（）

   from django.views.decorators.csrf import ensure_csrf_cookie
   
   @ensure_csrf_cookie
   def server(request):
   
       return render(request, ‘server.html‘)