Django API 测试：csrf 豁免

Question

每当我测试基于类的视图时，我都会收到 "Forbidden (CSRF cookie not set.): /user/admin/sign-up" 错误。当我将这些视图更改为基于函数的视图时，在函数声明之上使用@csrf_exempt，它可以工作。

邮递员 POST 请求：

• localhost:8000/admin/sign-up
• 正文：{'email' : 'email@gmail.com', 'password' : 123123}

网址路径模式：

...
path(‘/admin/sign-up’, views.AdminSignUpView),
...

Views.py

@csrf_exempt
def token_verification(request,**kwargs):
    if request.method == “POST”:
        id = kwargs.get(‘id’)
        token = kwargs.get(‘token’)
        user = User.objects.get(id = id)
        redirect_url = ‘/eval/intro’
        is_valid = user_activation_token.check_token(user,token)
        if is_valid:
            user.is_active = True
            user.save()
            return HttpResponseRedirect(redirect_url,status = 200)
        else:
            return HttpResponse(status = 403)


class AdminSignInView(View):
    @csrf_exempt
    def post(self,request):
        data = json.loads(request.body)
        try:
            if User.objects.filter(name = data[‘email’]).exists():
                user = User.objects.get(name=data[‘email’])

                if bcrypt.checkpw(data[‘password’].encode(‘utf-8’),user.password.encode(‘utf-8’)):
                    token  = jwt.encode({‘email’:data[‘email’]}, SECRET, algorithm = HASH).decode(‘utf-8’)
                    return JsonResponse({ ‘token’ : token }, status = 200)

                return JsonResponse({ ‘message’ : ‘INVALID_USER’ }, status = 401)
            return JsonResponse({ ‘message’ : ‘INVALID_USER’ }, status = 401)

        except KeyError:
            return JsonResponse({ ‘message’ : ‘INVALID_KEYS’ }, status = 400)



class AdminSignUpView(View):
    @csrf_exempt
    def post(self,request):
        try:
            data = json.loads(request.body)
            if not User.objects.filter(email = data[‘email’]).exists:
                password = bcrypt.hashpw(data[‘password’].encode(‘utf-8’),bcrypt.gensalt())
                crypted = password.decode(‘utf-8’)
                User.objects.create(
                    name  = data[‘name’],
                    password = bcrypt,
                    email = data[‘email’],
                    auth_id  = data[‘auth_id’]
                )
                return HttpResponse(status = 200)

        except KeyError:
                return JsonResponse({ ‘message’ : ‘INVALID_KEYS’ },status = 4000)

Models.py

class User(models.Model):
    name        = models.CharField(max_length = 50)
    email       = models.EmailField(max_length = 200,unique = True, blank = False)
    department  = models.ForeignKey('Department', on_delete = models.SET_NULL, null = True)
    is_active   = models.BooleanField(default=False)
    question    = models.ManyToManyField('eval.Question',through='UserQuestion')
    auth        = models.ForeignKey('Auth', on_delete = models.SET_NULL, null = True)

    class Meta:
        db_table = 'users'

token_verification 视图，它是基于函数编写的，工作正常，但最后两个引发了错误。我认为装饰器仅位于函数之上的事实会导致此错误，但我不确定为什么某些视图需要@csrf_exempt。

我不知道为什么我此时会收到 csrf 问题。

Answer 1

我相信问题出在您添加@csrf_exempt 的位置。 Django 在到达 post 之前执行 csrf 验证

您应该检查您的 Django 版本流程图，以找到您应该在视图上覆盖哪个方法来添加 csrf_exempt 装饰器。

https://docs.djangoproject.com/en/2.2/ref/class-based-views/base/#django.views.generic.base.View.setup

https://docs.djangoproject.com/en/1.8/ref/class-based-views/base/#django.views.generic.base.View

我相信下面的代码应该适用于 django 版本

    @method_decorator(csrf_exempt)
    def dispatch(self, request, *args, **kwargs):
        return super(AdminSignInView, self).dispatch(request, *args, **kwargs)