Thursday, 15 September 2011

javascript - Generate fresh django CSRF token on each login -


I want to log in form for my websites is a new token for each new CSRF that is generated fresh.

I tried to call

  logout (request) request.session.flush ()  

but the secret form area is always a It is the same token, even after restarting the server.

Its obvious meaning is that DJengo is reading data from the cookie. I do not mind this like cookies in this way and how does one generate a fresh one?

Alternatively, for me, an intermediate page clears all cookies before going to the actual login page? How to delete all cookies for your domain in a javascript

You can manually restore the token Is as follows:

 request.META _get_new_csrf_key django.middleware.csrf import  ["CSRF_COOKIE_USED"] = true request.META ["CSRF_COOKIE"] = _get_new_csrf_key ()  < / Pre> 

In Django> = 1.6, you should instead use django.middleware.csrf.rotate_token (request) , which actually does this.


No comments:

Post a Comment