3 ms·
> you still need hooks in place at your application level to be able to disable csrf checks Why would you want to disable the csrf check?
by zepolen 16y ago
> you still need hooks in place at your application level to be able to disable csrf checks
Why would you want to disable the csrf check?
- stevelosh 16y agoOne example: for AJAX requests. From http://docs.djangoproject.com/en/dev/ref/contrib/csrf/#ajax http://docs.djangoproject.com/en/dev/ref/contrib/csrf/#ajax Most modern JavaScript toolkits send an "X-Requested-With: XMLHttpRequest" HTTP header; these requests are detected and automatically not handled by this [CSRF] middleware. We can do this safely because, in the context of a browser, the header can only be added by using XMLHttpRequest, and browsers already implement a same-domain policy for XMLHttpRequest.
- zepolen 16y agoFair enough, but it doesn't mean your app requires hooks since the middleware can just not use CSRF if the x-requested-with header exists.