python - does both csrftoken cookie AND csrf_token INPUT type required in django -
what use of csrftoken-cookie in django when have send {% csrf_token %} in every form submission .
<form method="post" action="actionfile/"> {% csrf_token %} <button>submit</button> </form> the django processor allways asks {% csrf_token %}
do have put {% csrf_token %} in every form , can't django processor utilize csrftoken-cookie
{% csrf_token %} might required prevent forgery use of cookie
please clarify.,.,
cross-site request forgery, known one-click attack or session riding , abbreviated csrf or xsrf, type of malicious exploit of website whereby unauthorized commands transmitted user website trusts.unlike cross- site scripting (xss), exploits trust user has particular site, csrf exploits trust site has in user's browser. using secret cookie
remember cookies, secret ones, submitted every request. authentication tokens submitted regardless of whether or not end-user tricked submitting request. furthermore, session identifiers used application container associate request specific session object. session identifier not verify end-user intended submit request. only accepting post requests
applications can developed accept post requests execution of business logic. misconception since attacker cannot construct malicious link, csrf attack cannot executed. unfortunately, logic incorrect. there numerous methods in attacker can trick victim submitting forged post request, such simple form hosted in attacker's website hidden values. form can triggered automatically javascript or can triggered victim thinks form else. django sets csrftoken cookie every time when request server, , when post data client server token matches token, if matches no probs , if not matches throws error malicious request.
if can use csrf_exempt decorator disable csrf protection particular view.
from django.views.decorators.csrf import csrf_exempt then write @csrf_exempt before view
Comments
Post a Comment