CSRF, use JQUERY is not fully resolved, especially the development to late to solve loopholes CSRF attacks, to an almost finished project to add csrftoken each request, and csrfparam is terrible;

CSRF is mainly aim at ajax, here to take advantage of global ajax ajax requests to do an intercept,


Front end:





The $(document). AjaxSend (function (event, request, Settings) {
Var csrftoken=$(" # csrftoken "). Val ();
Request. SetRequestHeader (" csrftoken csrftoken);
Var url=Settings. The url;
If (Settings. Url. IndexOf ("?" )!=1) {
Settings. The url=url + "& amp; CsrfParam="+ csrftoken;
} else {
Settings. Url=url + "? CsrfParam="+ csrftoken;
}
});

Here does not recommend using ajaxStart embedded ajaxSetup;


Background:



Ifram can also be the same as the above processing

Solved such ajax CSRF attacks, for some export, link is his way to los first;