英文:
How to move only login page to another server with django (CSRF token missing)
问题
我有一个带有django
认证系统的登录页面。
现在,我想将登录页面移到另一台服务器(外部登录页面)。
所以,我的目的是在另一台服务器上创建用户名和密码字段(外部登录页面),然后登录到django系统。
我在另一台服务器上创建了HTML。
<form method="POST" action="http://djangoserver.com/">
<input type="text" name="username">
<input type="password" name="password">
<input type="submit">
</form>
然而,这显示了错误。
失败原因:
CSRF令牌丢失
我检查了登录页面的HTML源代码,正如django
自动创建的那样,确认了django中间件生成了csrf
。
<form method="POST">
<input type="hidden" name="csrfmiddlewaretoken" value="VEkMTu0EpmLbMVLRh4h9MOcuvcryIlA0M1USByG7R5PXkgYvMyzAhdKyq7gohpko">
Username
<input type="text" name="username" autofocus autocapitalize="none" autocomplete="username" maxlength="150" class="form-control" placeholder="Username" required id="id_username">
Password
<input type="password" name="password" autocomplete="current-password" class="form-control" placeholder="Password" required id="id_password">
<button type="submit">登录</button>
</form>
因此,我猜想我应该在外部登录页面中模仿这样的csrf
。
是否有任何好的建议?
英文:
I have login page with django
authentication system.
Now, I want to move only the login page to another server(external login page).
So, my purpose is make username and password field on another server(external login page), then login to the django system.
I made html on another server.
<form method="POST" action="http://djangoserver.com/">
<input type="text" name="username">
<input type="password" name="password">
<input type="submit">
</form>
However, this shows the error.
Reason given for failure:
CSRF token missing
I checked the login page html source as django
automatically created and confirmed there is csrf
that django middleware makes.
<form method="POST">
<input type="hidden" name="csrfmiddlewaretoken" value="VEkMTu0EpmLbMVLRh4h9MOcuvcryIlA0M1USByG7R5PXkgYvMyzAhdKyq7gohpko">
Username
<input type="text" name="username" autofocus autocapitalize="none" autocomplete="username" maxlength="150" class="form-control" placeholder="Username" required id="id_username">
Password
<input type="password" name="password" autocomplete="current-password" class="form-control" placeholder="Password" required id="id_password">
<button type="submit">login</button>
</form>
So, I guess I should mimic like this about csrf
in external login page.
Is there any good suggestion?
答案1
得分: 2
你需要在你的表单中添加 csrfmiddlewaretoken
字段。因为这个登录页面在实际服务器之外,所以你需要在项目中创建一个端点来生成 CSRF 令牌,并且你可以使用 JavaScript 调用它并将其放入你的表单中。以下是代码示例:
<form method="POST" action="http://YOUR-WEBSITE.XYZ/">
<input type="hidden" name="csrfmiddlewaretoken" id="csrf_token">
<input type="text" name="username">
<input type="password" name="password">
<input type="submit">
</form>
<script>
// 从 Django 服务器获取 CSRF 令牌
fetch('http://YOUR-WEBSITE.XYZ/csrf_token/')
.then(response => response.json())
.then(data => {
// 在表单中设置 CSRF 令牌值
document.getElementById('csrf_token').value = data.csrf_token;
});
</script>
而且你的应用视图应该是类似这样的:
from django.http import JsonResponse
from django.middleware.csrf import get_token
def get_csrf_token(request):
csrf_token = get_token(request)
return JsonResponse({'csrf_token': csrf_token})
确保在你的 Django 服务器的 URL 配置中包含此视图的 URL。
英文:
You have to add csrfmiddlewaretoken
field in your form. because this login page is outside of the actual server, you have to create an endpoint in the project to generate csrf token and you call it with javascript and put it in your form. here is the codes:
<form method="POST" action="http://YOUR-WEBSITE.XYZ/">
<input type="hidden" name="csrfmiddlewaretoken" id="csrf_token">
<input type="text" name="username">
<input type="password" name="password">
<input type="submit">
</form>
<script>
// Fetch the CSRF token from the Django server
fetch('http://YOUR-WEBSITE.XYZ/csrf_token/')
.then(response => response.json())
.then(data => {
// Set the CSRF token value in the form
document.getElementById('csrf_token').value = data.csrf_token;
});
</script>
and your view in the application should be something like this:
from django.http import JsonResponse
from django.middleware.csrf import get_token
def get_csrf_token(request):
csrf_token = get_token(request)
return JsonResponse({'csrf_token': csrf_token})
Make sure to include the URL for this view in your Django server's URL configuration.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。
评论