csrftoken
存储在哪里?
当我访问一个 API 端点(注销 API,不需要参数)时:
POST /rest-auth/logout/ HTTP/1.1
Host: 10.10.10.105:8001
Connection: keep-alive
Content-Length: 0
Accept: application/json, text/plain, */*
Origin: http://localhost:8080
Authorization: Token 0fe2977498e51ed12ddc93026b08ab0b1a06a434
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36
Referer: http://localhost:8080/register
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: sessionid=b95zopro0qvkrexj8kq6mzo1d3z2hvbl; csrftoken=z53lKL0f7VHkilYS5Ax8FMaQCU2ceouje9OeTJOgTy4gH0UgHVltAlOe2KFNNNB6
标题在上方。在响应中我得到了一个错误:
{"detail":"CSRF Failed: CSRF token missing or incorrect."}
因此,后端必须验证
csrftoken
。在后端数据库中,我找不到
csrftoken
字段:![enter image description here](https://istack.dev59.com/Z2Llo.webp)
所以我想知道它在加密的
session_data
中保存在哪里?
csrftoken
,它如何验证它? - user7693832csrf
验证。 - Anup Yadavcsrftoken
并将其设置为请求头x-csrftoken
:https://dev59.com/pqnka4cB1Zd3GeqPUtg8 - user7693832