当我们必须发送{% csrf_token %}时，django中的csrftoken-cookie有什么用？
在每个表单提交中。
<form method="post" action="actionFile/">
{% csrf_token %}
<button>Submit</button>
</form>
Django 处理器总是要求{% csrf_token %}
我们必须把{% csrf_token %} 放在每一种形式中吗，django 处理器不能使用csrftoken-cookie
{% csrf_token %} 可能需要防止伪造，但是 cookie 的用途是什么
请澄清。,.,
【问题讨论】：
Cross-site request forgery, also known as a one-click attack or session riding and
abbreviated as CSRF or XSRF, is a type of malicious exploit of a website whereby
unauthorized commands are transmitted from a user that the website trusts.Unlike cross-
site scripting (XSS), which exploits the trust a user has for a particular site, CSRF
exploits the trust that a site has in a user's browser.
使用秘密 cookie
Remember that all cookies, even the secret ones, will be submitted with every request.
All authentication tokens will be submitted regardless of whether or not the end-user
was tricked into submitting the request. Furthermore, session identifiers are simply
used by the application container to associate the request with a specific session
object. The session identifier does not verify that the end-user intended to submit
the request.
只接受 POST 请求
Applications can be developed to only accept POST requests for the execution of business
logic. The misconception is that since the attacker cannot construct a malicious link,
a CSRF attack cannot be executed. Unfortunately, this logic is incorrect. There are
numerous methods in which an attacker can trick a victim into submitting a forged POST
request, such as a simple form hosted in attacker's website with hidden values. This
form can be triggered automatically by JavaScript or can be triggered by the victim who
thinks form will do something else.
Django 每次请求服务器时都会设置 csrftoken cookie，并且当您将数据从客户端发布到服务器时，此令牌与该令牌匹配，如果它不匹配任何概率，如果不匹配则抛出错误，这是恶意请求。
如果您可以使用 csrf_exempt 装饰器来禁用特定视图的 CSRF 保护。
from django.views.decorators.csrf import csrf_exempt
然后在你的视图前写上@csrf_exempt
【讨论】：
CSRF 代表：跨站请求伪造
当涉及到 Web 应用程序时，这是一种非常常见的攻击。因此，不仅 Django，包括 Ruby on Rails 在内的大多数其他框架都提供了防止这种攻击的支持。
在 Django 中是通过发送 "csrfmiddlewaretoken" 作为 POST 数据来完成的。 Django 然后将这个令牌的值与合法的值匹配。如果它匹配请求通过，否则 引发错误。
{% csrf_token %} 模板标签 生成一个带有合法 CSRF 令牌值的隐藏输入字段。
所有的处理和异常引发都在 CsrfViewMiddleware 中完成。 你可以在 Django 文档中找到更多信息（解释得很好）：https://docs.djangoproject.com/en/1.6/ref/contrib/csrf/
【讨论】：