Python的Django框架入门踩过的坑（五）

csrf跨站请求伪造，方法一：在setting中把中间件的csrf注释掉，这样会被人恶意攻击，造成崩溃，一般不使用这种方法
方法二：使用标签{% csrf_token %}跨站伪造请求，加在form表单里面的任意位置，但是还有bug，还能恶意攻击，只是增加了一个hidden的隐藏域值，复制
源代码依然可以恶意攻击

方法三：使用验证码，防止表单恶意提交攻击

Forbidden (403)
CSRF verification failed. Request aborted.
You are seeing this message because this site requires a CSRF cookie when submitting forms. This cookie is required for security reasons, to ensure that your browser is not being hijacked by third parties.
If you have configured your browser to disable cookies, please re-enable them, at least for this site, or for 'same-origin' requests.