CSRF Failed: Referer checking failed - no Referer

postman模擬登錄出了這個錯誤,其實看標題就知道大概是怎么回事,網上大概找了辦法,也沒說到位,所以干脆自己找源碼了.

問題很明顯就是出在 CSRF 上,理所當然去查看 CsrfViewMiddleware 中間件:

class CsrfViewMiddleware(object):

    def _accept(self, request):
       
        request.csrf_processing_done = True
        return None

    def _reject(self, request, reason):
        logger.warning('Forbidden (%s): %s', reason, request.path,
            extra={
                'status_code': 403,
                'request': request,
            }
        )
        return _get_failure_view()(request, reason=reason)

    def process_view(self, request, callback, callback_args, callback_kwargs):

        if getattr(request, 'csrf_processing_done', False):
            return None

        try:
            csrf_token = _sanitize_token(
                request.COOKIES[settings.CSRF_COOKIE_NAME])
            request.META['CSRF_COOKIE'] = csrf_token
        except KeyError:
            csrf_token = None
           
            request.META["CSRF_COOKIE"] = _get_new_csrf_key()
        
            return None
e that anything not defined as 'safe' by RFC2616 needs protection
        if request.method not in ('GET', 'HEAD', 'OPTIONS', 'TRACE'):
            if getattr(request, '_dont_enforce_csrf_checks', False):
                return self._accept(request)

            if request.is_secure():
                referer = force_text(
                    request.META.get('HTTP_REFERER'),
                    strings_only=True,
                    errors='replace'
                )
                if referer is None:
                    return self._reject(request, REASON_NO_REFERER)　　　　　　# 問題就出在這里　　

                good_referer = 'https://%s/' % request.get_host()
                if not same_origin(referer, good_referer):
                    reason = REASON_BAD_REFERER % (referer, good_referer)
                    return self._reject(request, reason)

            if csrf_token is None:
                return self._reject(request, REASON_NO_CSRF_COOKIE)
            request_csrf_token = ""
            if request.method == "POST":
                try:
                    request_csrf_token = request.POST.get('csrfmiddlewaretoken', '')
                except IOError:
                    pass

            if request_csrf_token == "":
                request_csrf_token = request.META.get('HTTP_X_CSRFTOKEN', '')

            if not constant_time_compare(request_csrf_token, csrf_token):
                return self._reject(request, REASON_BAD_TOKEN)

        return self._accept(request)

首先在文件里面搜索報錯的信息字符串,找到這個:

REASON_NO_REFERER = "Referer checking failed - no Referer."

然后搜索 REASON_NO_REFERER 就會找到上面的那一段代碼中出錯的位置.(為什么寫這些東西,因為我有個同學就是從來都不會找出錯原因,方法有時候比結論更重要)

然后代碼里面說的很清楚了, referer = request.META.get('HTTP_REFERER') 

這就說明請求頭里面沒有 REFERER這個信息,都知道的,Django會把自定義的請求頭大寫並在前面添加 HTTP_ ,所以在postman的header里面添加這個 referer 字段就好了.

注意,referer的格式是 https://www.domain.com/.          后面有個點

然后就OK了

 

 

多說兩句,看看人家django多貼心,如果是post請求的話,會嘗試從兩個地方獲取csrftoken,請求體里面可以放,就算忘了放,還會從請求頭里面拿(54行 - 64行)