django csrf令牌錯誤（RequestContext沒有工作）

Question

我正在使用django 1.5.1，我必須在每個POST上使用{％csrf_token％}才能工作.RequestContext對我無效，這裏是我的設置，視圖代碼和模板代碼。

MIDDLEWARE_CLASSES = (
    'django.middleware.common.CommonMiddleware', 
    'django.contrib.sessions.middleware.SessionMiddleware', 
    'django.middleware.csrf.CsrfViewMiddleware', 
    'django.contrib.auth.middleware.AuthenticationMiddleware', 
    'django.contrib.messages.middleware.MessageMiddleware', 
) 

def show_rates(request, doc_id, template_name='rate.html'): 
    doc = get_object_or_404(Doctor, id=doc_id) 
    hos = doc.hospital 
    docts = hos.doctor_set.all() 
    page_title = doc.name 
    hos_name = hos.name 
    if request.method == "POST": 
     postdata = request.POST.copy() 
     form = AddToRateForm(postdata) 
    else: 
     form = AddToRateForm() 
    return render(request, template_name, locals()) 

<form method="POST" action="."> 
    {{ form.as_table }} 
    <div class="row-fluid"> 
     <div class="span10"> 
     </div> 
     <div class="span2"> 
      <button class="btn btn-block btn-primary" type="submit">Rate</button> 
     </div> 
    </div> 
</form> 

RequestContext不適用於我。我很困惑。

Answer 1

MIDDLEWARE_CLASSES看起來不錯。

這是您應該使用的基本代碼csrf。

from django.shortcuts import render 
from django.views.decorators.csrf import csrf_exempt, csrf_protect 

@csrf_protect 
#@csrf_exempt says to make an exemption on csrf, but of course is not secure. 
#@csrf_exempt 
def show_rates(request, doc_id, template_name='rate.html'): 
    ... 
    #I suppose that locals() returns a dict() 
    return render(request, template_name, locals()) 


<form method="POST" action=""> 
    {# Don't forget the following line #} 
    {% csrf_token %} 
    {{ form.as_table }} 
    <div class="row-fluid"> 
     <div class="span10"> 
     </div> 
     <div class="span2"> 
      <button class="btn btn-block btn-primary" type="submit">Rate</button> 
     </div> 
    </div> 
</form> 

Answer 2

嘗試更改您的視圖定義來添加這個裝飾：

@csrf_protect 
def show_rates(request, doc_id, template_name='rate.html'): 

和更新您的回報響應不包括context_instance。沒有必要真的。

return render_to_response(template_name, locals())