html 跨过CSRF验证

/*
 CSRF配置
 */
function csrfSafeMethod(method) {
    // these HTTP methods do not require CSRF protection
    return (/^(GET|HEAD|OPTIONS|TRACE)$/.test(method));
}

/*
 全局Ajax中添加请求头X-CSRFToken，用于跨过CSRF验证
 */
$.ajaxSetup({
    beforeSend: function (xhr, settings) {
        if (!csrfSafeMethod(settings.type) && !this.crossDomain) {
            xhr.setRequestHeader("X-CSRFToken", $.cookie('csrftoken'));
        }
    }
});

转载于:https://www.cnblogs.com/wt11/p/6516884.html