python - django 中需要 csrftoken cookie 和 csrf_token INPUT 类型吗

Question

当我们必须发送{% csrf_token %}时，django中的csrftoken-cookie有什么用在每个表单提交中。

<form method="post" action="actionFile/">
{% csrf_token %}

<button>Submit</button>

</form>

Django 处理器总是要求 {% csrf_token %}

我们是否必须在每个表单中放入{% csrf_token %}，django处理器不能利用csrftoken-cookie

{% csrf_token %} 可能需要防止伪造，但是 cookie 有什么用

请澄清.,.,

Answer 1

Cross-site request forgery :

Cross-site request forgery, also known as a one-click attack or session riding and
abbreviated as CSRF or XSRF, is a type of malicious exploit of a website whereby  
unauthorized commands are transmitted from a user that the website trusts.Unlike cross-
site scripting (XSS), which exploits the trust a user has for a particular site, CSRF 
exploits the trust that a site has in a user's browser.

使用 secret cookie

Remember that all cookies, even the secret ones, will be submitted with every request.
All authentication tokens will be submitted regardless of whether or not the end-user 
was tricked into submitting the request. Furthermore, session identifiers are simply
used by the application container to associate the request with a specific session 
object. The session identifier does not verify that the end-user intended to submit
the request.

仅接受 POST 请求

Applications can be developed to only accept POST requests for the execution of business 
logic. The misconception is that since the attacker cannot construct a malicious link,
a CSRF attack cannot be executed. Unfortunately, this logic is incorrect. There are
numerous methods in which an attacker can trick a victim into submitting a forged POST
request, such as a simple form hosted in attacker's website with hidden values. This 
form can be triggered automatically by JavaScript or can be triggered by the victim who
thinks form will do something else.

Reference link

每次请求服务器时，Django 都会设置 csrftoken cookie，并且当您将数据从客户端发布到服务器时，此 token 与该 token 匹配，如果不匹配任何问题，如果不匹配，则会抛出错误，这是恶意请求。

如果您可以使用 csrf_exempt 装饰器来禁用特定 View 的 CSRF 保护。

from django.views.decorators.csrf import csrf_exempt

然后在 View 前写入@csrf_exempt