CSRF-跨域访问保护

CSRF跨域访问保护

当我们打开此功能时，在提交时就会报错，此时解决方法有

1.浏览器支持cookie

2.有render方法

3.在提交的表单中加入{% csrf_token%}，为了生成随机值。

现在我们就以第三种为例,就可以解决此类问题了

{% extends "index.html" %}

{% block extra-head-resources %}

     <script src="/static/plugins/ckeditor/ckeditor.js"></script>
{% endblock %}

{% block container %}

<div style="min-height: 600px;padding-bottom: 50px">

    <form method="post" enctype="multipart/form-data"> {% csrf_token %}

        {% for field in form %}
            <div class="form-group">
                <label  class="col-sm-2 control-label">{{ field.name }}</label>
                <div class="col-sm-10">
                  {{ field }}
                  <span style="color: red">{{ field.errors }}</span>
                </div>
            </div>

        {% endfor %}
        <input type="submit" class="col-lg-offset-5 btn btn-sm btn-success" value="提交">
    </form>
</div>


<script>
    // Replace the <textarea id="editor1"> with a CKEditor
    // instance, using default configuration.
    CKEDITOR.replace( 'id_body' );
</script>


{% endblock %}

 为了防止CSRF攻击，分辨来源，将随机值放在页面中，而不是放在POST请求中，这样就不会被恶意使用。

Middleware中间件

为了能使用户对django的request/response请求处理过程及请求数据包进行全局的更改，比如对所有的请求进行是否已登录的验证，是否有注入或其他攻击行为的检测等，django提供了一个轻量级、底层的钩子插件，就叫中间件。

MIDDLEWARE = [
'django.middleware.security.SecurityMiddleware',     进行一些请求的安全验证，xss攻击过滤，ssl重定向（自动重定向到https）
'django.contrib.sessions.middleware.SessionMiddleware',     启用对session的支持
'django.middleware.common.CommonMiddleware',             做一些常用的小功能，检测url，会自动把foo.com/bar，重定向程foo.com/bar/
'django.middleware.csrf.CsrfViewMiddleware',                     跨域请求保护
'django.contrib.auth.middleware.AuthenticationMiddleware',    认证
'django.contrib.messages.middleware.MessageMiddleware',      启用django自带的消息日志插件
'django.middleware.clickjacking.XFrameOptionsMiddleware',    点击劫持
]

自定义中间件

要在settings中，将自己创建的申明

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
    'bbs.test_middleware.SimpleMiddleware'
]

from django.shortcuts import render,HttpResponse,redirect
class SimpleMiddleware(object):
    def __init__(self, get_response):
        self.get_response = get_response
        # One-time configuration and initialization.


    def __call__(self, request):
        # Code to be executed for each request before
        # the view (and later middleware) are called.

        response = self.get_response(request)
        print("middleware",response)

        # Code to be executed for each request/response after
        # the view is called.

        return response
    def process_view(self,request,view_func,view_args,view_kwargs):
        print('process view',self,request,view_func,view_args,view_kwargs)
    def process_exception(self,request,exception):
        print('process excetion',request,exception)
        return HttpResponse('error happend....%s' % exception)

    def process_template_reponse(self,request,response):
        print('process_template_reponse',request,response)