Django/django
11
0
Fork 0
Code Pull Requests Projects Releases Activity

[1.1.X] Fixed #15284 - improved example jQuery code for adding X-CSRF-Token

Browse Source 
Using the ajaxSend event is better than beforeSend, because the beforeSend
callback can have only one value, which makes it painful if it is needed by
multiple bits of javascript.

Thanks to LukeMaurer for report and initial patch.

Backport of [15515] from trunk.

This is backported to 1.1.X because it really belongs with security patch [15466]

git-svn-id: http://code.djangoproject.com/svn/django/branches/releases/1.1.X@15518 bcc190cf-cafb-0310-a4f2-bffc1f526a37
This commit is contained in:
Luke Plant 2011-02-12 23:49:18 +00:00
parent 99c529eec8
commit 840314bde4
1 changed files with 6 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
docs/ref/contrib/csrf.txt
View File

@ -48,17 +48,15 @@ document and pass it in as POST data with every POST request. For this reason,
there is an alternative method: on each XMLHttpRequest, set a custom
`X-CSRFToken` header to the value of the CSRF token. This is often easier,
because many javascript frameworks provide hooks that allow headers to be set on
every request. In jQuery, you can use the ``beforeSend`` hook as follows:
every request. In jQuery, you can use the ``ajaxSend`` event as follows:
.. code-block:: javascript
$.ajaxSetup({
beforeSend: function(xhr, settings) {
if (!(/^http:.*/.test(settings.url) || /^https:.*/.test(settings.url))) {
// Only send the token to relative URLs i.e. locally.
xhr.setRequestHeader("X-CSRFToken",
$("#csrfmiddlewaretoken").val());
}
$('html').ajaxSend(function(event, xhr, settings) {
if (!(/^http:.*/.test(settings.url) || /^https:.*/.test(settings.url))) {
// Only send the token to relative URLs i.e. locally.
xhr.setRequestHeader("X-CSRFToken",
$("#csrfmiddlewaretoken").val());
}
});