Csrf 及ajax的csrf 請求
阿新 • • 發佈：2017-12-06
ava quest ack body bytes ajax使用 fin byte call
#!/usr/bin/python # -*- coding: UTF-8 -*- #驗證碼 import tornado.ioloop import tornado.web class CrsfHandler(tornado.web.RequestHandler): def get(self, *args, **kwargs): self.render("crsf.html") def post(self, *args, **kwargs): self.write("csrf.post") settings = { "xsrf_cookies": True, } class CheckCodeHandler(tornado.web.RequestHandler): def get(self): import io import check_code mstream = io.BytesIO() # 創建圖片 寫入驗證碼 img, code = check_code.create_validate_code() # 圖片對象寫入到mstream img.save(mstream, "GIF") # self.session["CheckCode"] = codeprint(mstream.getvalue()) self.write(mstream.getvalue()) class MainHandler(tornado.web.RequestHandler): def get(self): self.render("index.html",) application = tornado.web.Application([ (r"/index", MainHandler), #(r"/check_code", CheckCodeHandler), (r"/crsf", CrsfHandler), ],**settings) if __name__ == "__main__": application.listen(5555) tornado.ioloop.IOLoop.instance().start()
<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Title</title> </head> <body> <form action="/crsf" method="post"> {% raw xsrf_form_html() %} <p><input name="name" value=""></p> <p><input name="pwd" value=""></p> <p> <input name="valide" value="" placeholder="驗證碼"> <input type="submit" value="submit" > </p> </form> <script type="text/javascript"> function ChangeCode() { var code = document.getElementById(‘imgCode‘); code.src += ‘?‘; } </script> </body> </html>
Ajax使用時，本質上就是去獲取本地的cookie，攜帶cookie再來發送請求
function getCookie(name) {
var r = document.cookie.match("\\b" + name + "=([^;]*)\\b");
return r ? r[1] : undefined;
}
jQuery.postJSON = function(url, args, callback) {
args._xsrf = getCookie("_xsrf");
$.ajax({url: url, data: $.param(args), dataType: "text", type: "POST",
success: function(response) {
callback(eval("(" + response + ")"));
}});
};Csrf 及ajax的csrf 請求