注销后Django无法删除csrftoken答案

【问题标题】：Django can not delete csrftoken after logout注销后Django无法删除csrftoken
【发布时间】：2013-09-28 04:07:12
【问题描述】：

我正在使用 varnish 作为 Django 应用程序的前端缓存。这一切都适用于 VCL 配置。我遇到的问题是，在用户注销后，csrftoken cookie 没有被删除，从那时起，varnish 有一个 MISS 响应而不是 HIT。在stackoverflow上阅读了一些相关问题后，我有这个注销视图

def logout_view(request):
    response = render_to_response('registration/logout.html', {}, context_instance=RequestContext(request))

    if request.user.is_authenticated():
        logout(request)

        if request.GET.get('next', False):
           response = HttpResponseRedirect(next)

    response.delete_cookie('sessionid')
    response.delete_cookie('csrftoken')
    return response

以及用户点击注销页面后的此响应标头

Response Headers
Age:0
Cache-Control:max-age=600
Connection:keep-alive
Content-Language:en
Content-Type:text/html; charset=utf-8
Date:Mon, 23 Sep 2013 09:20:43 GMT
Expires:Mon, 23 Sep 2013 09:30:43 GMT
P3P:CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Server:nginx/1.4.1
Set-Cookie:sessionid=; expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Path=/
Set-Cookie:csrftoken=; expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Path=/
Transfer-Encoding:chunked
Vary:Cookie, Accept-Language, Host
Via:1.1 varnish
X-Cache:MISS
X-Varnish:1950616479

default.vcl 以确保完整性：

backend default {
    .host = "127.0.0.1";
    .port = "8000";
}

sub vcl_recv {
    set req.grace = 15s;

    if (req.http.Cookie) {
        set req.http.Cookie = regsuball(req.http.Cookie, "(^|; ) *__utm.=[^;]+;? *", "\1"); # removes all cookies named __utm? (utma, utmb...) - tracking thing
    }

    # unless sessionid/csrftoken is in the request, don't pass ANY cookies (referral_source, utm, etc)
    if (req.request == "GET" && (req.url ~ "^/static" || (req.http.cookie !~ "flash_sessionid" && req.http.cookie !~ "csrftoken"))) {
        remove req.http.Cookie;
    }

    # normalize accept-encoding to account for different browsers
    # see: https://www.varnish-cache.org/trac/wiki/VCLExampleNormalizeAcceptEncoding
    if (req.http.Accept-Encoding) {
        if (req.http.Accept-Encoding ~ "gzip") {
            set req.http.Accept-Encoding = "gzip";
        } elsif (req.http.Accept-Encoding ~ "deflate") {
            set req.http.Accept-Encoding = "deflate";
        } else {  
            # unknown algorithm  
            remove req.http.Accept-Encoding;
        }
    }
}

sub vcl_fetch {
    set beresp.ttl = 300s;
    set beresp.grace = 15s;

    # static files always cached 
    if (req.url ~ "^/static") {
       unset beresp.http.set-cookie;
       return (deliver);  
    }

    # pass through for anything with a session/csrftoken set
    if (beresp.http.set-cookie ~ "flash_sessionid" || beresp.http.set-cookie ~ "csrftoken") {
       return (hit_for_pass);
    } else {
       return (deliver);
    }
}

sub vcl_deliver {
    # Add a header to indicate a cache HIT/MISS
    if (obj.hits > 0) {
        set resp.http.X-Cache = "HIT";
    } else {
        set resp.http.X-Cache = "MISS";
    }
    return (deliver);
}

在响应标头上，我看到 Django 将 cookie 值设置为过去的日期，但是 csrftoken cookie 仍然存在于下一个请求中。

我还尝试删除 'django.middleware.csrf.CsrfViewMiddleware' 中间件，但 cookie 仍然存在。

【问题讨论】：

标签： django caching varnish django-csrf

【解决方案1】：

您可以通过如下编辑您的 vcl_fetch 来解决此问题：

sub vcl_fetch {
    # pass through for anything with a session/csrftoken set
    if (beresp.http.set-cookie ~ "flash_sessionid" || beresp.http.set-cookie ~ "csrftoken" || beresp.http.set-cookie ~ "sessionid") {
       return (hit_for_pass);
    } else {
       return (deliver);
    }
}

这样你也可以检查Set-Cookie:sessionid。

在使用 beresp.http.set-cookie 时，Varnish 只看到第一个 Set-Cookie 标头，因此在您的情况下，Varnish 返回 vcl_deliver 而不是 hit_for_pass。

如需进一步阅读，我建议您查看vmod_header。

【讨论】：