python 2.7 - Handling CSRF tokens in Django -


i've written small standalone python script that's calling django-based backend , working fine login , calling views requiring auth , on.

a bit of code

def dostuff():     session = login(username, password)     license = add_license(session)  def _helper(self, url, cookie=none):     http = httplib2.http()     if cookie:         headers = { "cookie" : cookie }     else:         headers = {}     response, content = http.request(host + url, "get", headers=headers, body="")     return response, content  def login(self, username, password):     url = "/license/login?username=%s&password=%s" % (username, password)     response, content = self._helper(url)     sessioncookie = response["set-cookie"]     customer_id = re.search("id=(?p<id>\d+)", content)     if response["status"] == "200":         return sessioncookie, customer_id.group("id")  def add_license(self, session):     cookie = session[0]     customer_id = int(session[1])-1     url = "/license/add_license?customer_id=%s" % customer_id     response, content = self._helper(url, cookie)     content = content[1:-1]     if response["status"] == "200": #ok         data = json.loads(content)         return data["fields"]

if cahnge "get" "post" encounter django csrf-error page(csrf verification failed) in return. how can send post data django?

my login view in django, need special add csrf token? plan rewrite send json once things working.

 def my_login(request):     done, username = get_input(request, "username")     if not done:         return username     done, password = get_input(request, "password")     if not done:         return password     user = authenticate(username=username, password=password)     if user not none:        if user.is_active:             login(request, user)             return httpresponse("done, id=%s" % user.pk)         else:             return httpresponse("user disabled")     else:         return httpresponse("invalid login")

i got working , how did it. suggested toto_tico worte dummy view retrieve thought get csrf token. @ first didn't send csrf token on had add decorator ensure_csrf_cookie.

@ensure_csrf_cookie def dummy(request):     return httpresponse("done")

and handle login requests normally.

def my_login(request):     ...handle login...

it turned out adding cookie post wasn't enough, had write token post data well.

def _helper(self, url, method="post"):     req = urllib2.request(host + url)     self.cookiemgr.add_cookie_header(req)     try:         if method == "get":             response = self.opener.open(req)         else:             cookie in self.cookiemgr:                 if cookie.name == "csrftoken":                     csrf = cookie.value             values = { "csrfmiddlewaretoken" : csrf}             params = urllib.urlencode(values)             response = self.opener.open(req, params)             code = response.getcode()             info = response.info()             content = response.read()             return code, info, content     except urllib2.httperror ex:         print str(ex)         sys.exit(1)  def get_csrf(self):     url = "/license/dummy"     self._helper(url, method="get")  def login(self, username, password):     self.get_csrf()     url = "/license/login?username=%s&password=%s" % (username, password)     code, info, content = self._helper(url)     if code == 200:         #done!

Comments

Post a Comment

Popular posts from this blog

java - Cast from Object to List<String>: CastClassException -

i'm using touchdb ektorp in android app access couchdb the json document i'm accessing has array of categories: categories: ['cat1', 'cat2'] in view query i'm trying access array classcastexception when trying convert result object list: public void map(map<string, object> document, tdviewmapemitblock emitter) { object dateadded = document.get("dateadded"); object expirydate = document.get("expirydate"); boolean expired = false; if(expirydate!=null){ expired = comparedate.isitemexpired(expirydate); } list<string> test = (list<string>)document.get("categories"); the .get() method works fine single json fields. ideas? document declared map<string, object> so when .get() - return object. there's no direct mapping (list<string>) exception saying need cast object rather list. you ch...
Read more

How to set a border for android Imageview in Longpress? -

in android application want set border imageview when long pressed. want remove same(border) when user releases view. please anyone, me in this? @override public boolean ontouchevent(motionevent event) { switch (event.getaction()) { case motionevent.action_down: { mtouchdownx = (int) event.getx(); mtouchdowny = (int) event.gety(); break; } case motionevent.action_move: { int x = (int) event.getx(); int y = (int) event.gety(); if (mdraggeditem >= 0) { setdraggeditemposition(x, y); int index = getindexfromcoordinates(x, y); if (index == mdraggeditem || index < 0) break; if (index < mdraggeditem) { (int = index; < mdraggeditem; i++) { moveviewtoposition(i, i+1); } (int = mdraggeditem-1; >= index; i--) { ...
Read more

c# - Operator '==' incompatible with operand types 'Guid' and 'Guid' using DynamicExpression.ParseLambda<T, bool> -

i'm using dynamic linq library , there source code , basic docu , nuget version pm> install-package dynamiclinq i'm trying construct clause involves guids i have tried string "id == @0" . parameter array object[] value ( guid xxxx ) var whereclausesb = buildlogicalkeywhereclause2(entity, logicalkey); //build string var parms = buildparamarray(entity, logicalkey); // object[] var wherelambda = ofsi.bos.core.dynamicexpression.parselambda<t, bool>(whereclausesb.tostring(),parms); //parse an exception thrown in dynamicexpression.parselambda operator '==' incompatible operand types 'guid' , 'guid' i have tried guid , string.(fail) i tried , "id = @0" (fail). string == string works, int32==int32 not guid == guid not any ideas? try using equals method instead of == operator in string: "id.equals(@0)"
Read more