weixin_33743661 2020-01-09 15:25 采纳率: 0%
浏览 102

Ajax带烧瓶-seasurf调用

I am developing a small app on localhost and using flask-seasurf to prevent csrf attacks. All my non-ajax forms work correctly with flask-seasurf. I have one form that triggers an ajax call to '/checkajax' on form submit; this worked until I started to use flask-seasurf but now I get a console error and the ajax doesn't work:

Warning in flask_seasurf: Forbidden (CSRF token missing or incorrect): /checkajax 

The form triggering the ajax call has the standard hidden field containing the 'csrf_token()' function call of flask-seasurf embedded in the jinja page template:

<input id="csrf-token" type="hidden" name="_csrf_token" value="{{ csrf_token() }}">

The ajax call structure is:

$("#submit").submit(function(event) {
    event.preventDefault();
    $.ajax({
        url: "/checkajax",
        data: {...},
        type: "POST",
        datatype: "text",
        success: function(response){
            ...
        },
        error: function(response) {
            ...
        }
    });
});

I can see from the site cookie that there is an entry for '_csrf_token' generated by flask-seasurf. Can anyone give some insight as to why this ajax call is now not working?

  • 写回答

1条回答 默认 最新

  • 程序go 2020-01-09 16:53
    关注

    The solution to my problem was to modify the header of the ajax call to include X-CSRFToken defined as the flask-seasurf token from my form:

    var csrf_token = $("csrf-token").val()
    
    $("#submit").submit(function(event) {
        event.preventDefault();
        $.ajax({
            headers: {"X-CSRFToken", csrf_token},
            url: "/checkajax",
            data: {...},
            type: "POST",
            datatype: "text",
            success: function(response){
                ...
            },
            error: function(response) {
                ...
            }
        });
    });
    

    Hope that helps someone else.

    评论

报告相同问题?

悬赏问题

  • ¥15 关于#wireshark#的问题:并且能够给数据做标注,如这个流量是在看视频或者是在转账
  • ¥90 请问,这个视频播放软件的名称,用过的朋友请给答案,上方..avi是啥意思?是看短剧还是播放本地视频?
  • ¥15 运筹优化,gurobi,python
  • ¥15 基于python的电影系统推荐
  • ¥20 springmvc重定向和返回json
  • ¥15 数学建模——参会安排怎么做
  • ¥15 电脑键盘实现触摸功能
  • ¥25 matlab无法将表达式转换为双数组怎么解决?
  • ¥15 单片机汇编语言相关程序
  • ¥20 家用射频美容仪技术规格