CSRF失败：从1.8升级到django 1.10后，CSRF令牌丢失或不正确

Question

我通过AJAX向api发送帖子请求（当前页面和api都在同一主机下）。我得到了csrf failed: csrf token missing or incorrect error。这发生在我从1.8升级到django 1.10时。我也检查了django 1.9，错误仍然存​​在于1.9。这是细节卷曲：

curl 'https://tru-staging.com/pagemaker/api/v1/carousel/slide/' -H 'Pragma: no-cache' -H 'Origin: https://tru-staging.com' -H 'Accept-Encoding: gzip, deflate, br' -H 'Accept-Language: en-US,en;q=0.8,ar;q=0.6' -H 'Authorization: Token undefined' -H 'Content-Type: application/json;charset=UTF-8' -H 'Accept: application/json, text/plain, */*' -H 'Cache-Control: no-cache' -H 'X-CSRFToken: UMQPAIb1OTl7MyiQLJttdKE8xOLz35pMaHeNGMMDqy0Jn3x8SpbaEUmzOQk7Fppr' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.95 Safari/537.36' -H 'Cookie: _ga=GA1.2.2131330908.1484113382; sessionid=nnxqi67j18tblt985vayyz4ssyhdnfjm; csrftoken=o6gjW1Sxb1X23hI9RurDIAXjSuEbbgbMQJtMQyS2gT1yTnCGF80rmmB8pwSOSKKj' -H 'Connection: keep-alive' -H 'Referer: https://tru-staging.com/68/school_landing/' --data-binary '{"order":4,"carousel":736}' —compressed

Answer 1

X-CSRFToken标头与上面命令行中的csrftoken Cookie值不匹配。具体的错误消息来自：

https://github.com/django/django/blob/master/django/middleware/csrf.py#L313

这表明CSRF令牌确实不匹配。