Skip to content

Instantly share code, notes, and snippets.

@alanhamlett
Last active January 13, 2021 02:18
Show Gist options
  • Save alanhamlett/6316427 to your computer and use it in GitHub Desktop.
Save alanhamlett/6316427 to your computer and use it in GitHub Desktop.
Sets the X-CSRFToken header for every jQuery ajax non-GET request to make CSRF protection easy. This fixes the example from Django docs here: https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#ajax
$.ajaxSetup({
beforeSend: function(xhr, settings) {
if (settings.type == 'POST' || settings.type == 'PUT' || settings.type == 'DELETE') {
function getCookie(name) {
var cookieValue = null;
if (document.cookie && document.cookie != '') {
var cookies = document.cookie.split(';');
for (var i = 0; i < cookies.length; i++) {
var cookie = jQuery.trim(cookies[i]);
// Does this cookie string begin with the name we want?
if (cookie.substring(0, name.length + 1) == (name + '=')) {
cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
break;
}
}
}
return cookieValue;
}
if (!(/^http:.*/.test(settings.url) || /^https:.*/.test(settings.url))) {
// Only send the token to relative URLs i.e. locally.
xhr.setRequestHeader("X-CSRFToken", getCookie('csrftoken'));
}
}
}
});
@ccasallas
Copy link

Hi,

Why does getCookie function is declared within conditional? Is it about concurrency?
Thanks,

Carlos.

@imajkumar
Copy link

please explain implementation

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment