python+django+dwz ajax form 403

近期用python+django+apache+dwz做一个订单系统，遇到的最头疼的问题就是在用ajax时出现403forbidden错误。最后解决如下：

1.html中：

<form method="post" action="launch_order_do.html" class="pageForm required-validate" οnsubmit="return validateCallback(this, dialogAjaxDone)">{% csrf_token %}

<select  name="teamId" οnchange="selectGroupAndReturnUsers(this.value)">
	                {%for team in teams%}
	                    <option value ="{{team.id}}" class="required">{{team.name}}</option>
	                {%endfor%}
                </select>

2.在index.html中引入所写的js

<script src="http://localhost/zt/a120910consumemanage/javascripts/wangyang.js" type="text/javascript"></script>

3.wangyang.js（放在apache中C:\MyWorks\components\apache2.2\htdocs\zt\a120910consumemanage\javascripts\wangyang.js）实现如下:

function selectGroupAndReturnUsers(value) {
alert(value);
$.ajax( {
        url : "select_group_and_return_users.html",
        type : "post",
        dataType : "text",
        data : "teamId=" + value,
        timeout : 10000,
        error :  function(data){alert("Server didn't return data");},
        beforeSend: function(XMLHttpRequest){
            XMLHttpRequest.setRequestHeader("RequestType", "ajax");
            },
        success : function(data) {
            alert("succ");
            var dataObj = eval("(" + data + ")");// 转换为json对象
            alert(data);
	            if(dataObj.msg == '1') {
	            	document.getElementById("teamLabel").value = "woods";
	            } else {
	            	document.getElementById("teamLabel").value = "123";
	            }
            }
        });
}

4.在urls.py中配置如下：

    url(r'^select_group_and_return_users.html?$', selectGroupAndReturnUsers),

5.在viewsonic.py中调用如下：

teamId = request.REQUEST.get('teamId', "")
    userTeamObjs = A120910ConsumemanageUserTeam.objects.using("zt").filter(team_id = teamId)
    if not userTeamObjs :
        return None
    userTeamObjs[0].user.name
    jsonData={"team":'userTeamObjs', "username":'woods'}
    return HttpResponse(simplejson.JSONEncoder().encode(jsonData), mimetype="application/json")

6.在index中加入如下代码：

<script type="text/javascript">
$(function(){    
    DWZ.init("/b120910consumemanage/dwz.frag.xml", {
//        loginUrl:"loginsub.html", loginTitle:"登录",    // 弹出登录对话框
        loginUrl:"/b120910consumemanage/login.html",    // 跳到登录页面
        debug:false,    // 调试模式 【true|false】
        callback:function(){
            initEnv();
            $("#themeList").theme({themeBase:"themes"});
        }
    });
});
//清理浏览器内存,只对IE起效,FF不需要
if ($.browser.msie) {
    window.setInterval("CollectGarbage();", 10000);
}

//新加处理ajax提交表单的处理方式  
jQuery(document).ajaxSend(function(event, xhr, settings) {  
    function getCookie(name) {  
        var cookieValue = null;  
        if (document.cookie &&document.cookie != '') {  
            var cookies= document.cookie.split(';');  
            for (var i =0; i < cookies.length; i++) {  
               var cookie = jQuery.trim(cookies[i]);  
               // Does this cookie string begin with the name we want?  
               if (cookie.substring(0, name.length + 1) == (name + '=')) {  
                   cookieValue = decodeURIComponent(cookie.substring(name.length + 1));  
                   break;  
               }  
            }  
        }  
        return cookieValue;  
    }  
    function sameOrigin(url) {  
        // url could be relative or schemerelative or absolute  
        var host = document.location.host;// host + port  
        var protocol =document.location.protocol;  
        var sr_origin = '//' + host;  
        var origin = protocol + sr_origin;  
        // Allow absolute or scheme relativeURLs to same origin  
        return (url == origin ||url.slice(0, origin.length + 1) == origin + '/') ||  
            (url ==sr_origin || url.slice(0, sr_origin.length + 1) == sr_origin + '/') ||  
            // or anyother URL that isn't scheme relative or absolute i.e relative.  
           !(/^(\/\/|http:|https:).*/.test(url));  
    }  
    function safeMethod(method) {  
        return(/^(GET|HEAD|OPTIONS|TRACE)$/.test(method));  
    }  
    if(!safeMethod(settings.type) && sameOrigin(settings.url)) {  
       xhr.setRequestHeader("X-CSRFToken", getCookie('csrftoken'));  
    }  
});  

</script>

7.有关403forbidden的详细讲解参照：

http://blog.csdn.net/wujingwen1111/article/details/7870252

8.运行效果如下

解释：其中123就是动态更新的信息。显示过程中alter的弹框是为了调试。可以根据需要去掉。