禁止 (403) CSRF 验证失败。请求中止

Question

我正在尝试将表单中的数据发布到名为 insert_data 的 url。表单发布的数据应插入数据库。当我点击提交按钮时填写表格后出现错误。我在表单中包含了 {% csrf_token %}。我提到了许多有关此错误的解决方案，但无济于事。

Forbidden (403)
CSRF verification failed. Request aborted.

urls.py:

from django.conf.urls import url
from . import views

urlpatterns = [
    url(r'^$', views.index, name='index'),
    url(r'^chain$', views.chain, name='chain'),
    url(r'^add$', views.add, name='add'),
    url(r'^insert_order$', views.insert_order, name='insert_order'),
]

views.py

from django.shortcuts import render, render_to_response
from .models import Customers
from django.db import connection

def add(request):
    cursor = connection.cursor()
    cursor.execute('''select polls_products.modelNumber, polls_products.description, polls_products.cost from polls_products;''')
    results = cursor.fetchall()
    x = cursor.description
        resultsList = []   
        for r in results:
            i = 0
            d = {}
            while i < len(x):
                d[x[i][0]] = r[i]
                i = i+1
            resultsList.append(d)

    cursor1 = connection.cursor()
    cursor1.execute('''select polls_employees.first_name, polls_employees.last_name from polls_employees;''')
    results1 = cursor1.fetchall()
    x = cursor1.description
        resultsList1 = []   
        for r in results1:
            i = 0
            d = {}
            while i < len(x):
                d[x[i][0]] = r[i]
                i = i+1
            resultsList1.append(d)
    return render_to_response('polls/add.html', {"results1":resultsList1, "results":resultsList})

def insert_order(request):
    print "came"
    if request.method == "POST":
            print request.POST['product']
            print request.POST['emp']

        return render(request, 'polls/index.html', {})

添加.html

<h1>Add Orders</h1>

<form action="{% url 'insert_order' %}" method="POST">
    {% csrf_token %}
Product: <select name="product">
<option disabled="disabled" selected="selected">select product</option>
    {% for r in results %}

            <option value="{{r.key}}" >{{r.modelNumber}} {{r.description}} {{r.cost}}</option>

    {% endfor %}
</select>
<br/><br/>
Employee: <select name="emp">
<option disabled="disabled" selected="selected">select Employee</option>
{% for r in results1 %}
     <option value="{{r.key}}" >{{r.first_name}} {{r.last_name}} </option>
{% endfor %}
</select>
<br/><br/>
<h3>Customer Details</h3>
First Name: <input type="text" id="fname" name="fname">
<br/><br/>
last Name: <input type="text" id="fname" name="fname">
<br/><br/>
City: <input type="text" id="fname" name="fname">
<br/><br/>
State: <input type="text" id="fname" name="fname">
<br/><br/>
Phone No: <input type="text" id="fname" name="fname">
<br/><br/>
<input type="submit" value="Save Order">
</form>

请帮忙。我真的被困在了这一点上。

Answer 1

如果您没有在应用中使用用户身份验证，请尝试使用 django 装饰器@crsf_exempt

例如：

from django.views.decorators.csrf import csrf_exempt

@csrf_exempt
def add(request):
   ...

@csrf_exempt
def insert_order(request):
       ...

Answer 2

每次使用renter_to_response时都必须使用RequestContext(request)

return render_to_response("login.html", {"registration_id":registration_id}, context_instance=RequestContext(request))

你必须导入身份验证和登录：

from django.contrib.auth import authenticate, login

在设置更新中

SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
SESSION_EXPIRE_AT_BROWSER_CLOSE = True
MIDDLEWARE_CLASSES = [
    "django.middleware.csrf.CsrfViewMiddleware",
    "django.middleware.common.CommonMiddleware",
    "django.contrib.sessions.middleware.SessionMiddleware",
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "django.contrib.messages.middleware.MessageMiddleware",
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

请参考 https://docs.djangoproject.com/ja/1.9/ref/csrf/