1 class CsrfViewMiddleware(object):
 2
 3     def _accept(self, request):
 4
 5         request.csrf_processing_done = True
 6         return None
 7
 8     def _reject(self, request, reason):
 9         logger.warning('Forbidden (%s): %s', reason, request.path,
10             extra={
11                 'status_code': 403,
12                 'request': request,
13             }
14         )
15         return _get_failure_view()(request, reason=reason)
16
17     def process_view(self, request, callback, callback_args, callback_kwargs):
18
19         if getattr(request, 'csrf_processing_done', False):
20             return None
21
22         try:
23             csrf_token = _sanitize_token(
24                 request.COOKIES[settings.CSRF_COOKIE_NAME])
25             request.META['CSRF_COOKIE'] = csrf_token
26         except KeyError:
27             csrf_token = None
28
29             request.META["CSRF_COOKIE"] = _get_new_csrf_key()
30
31             return None
32 e that anything not defined as 'safe' by RFC2616 needs protection
33         if request.method not in ('GET', 'HEAD', 'OPTIONS', 'TRACE'):
34             if getattr(request, '_dont_enforce_csrf_checks', False):
35                 return self._accept(request)
36
37             if request.is_secure():
38                 referer = force_text(
39                     request.META.get('HTTP_REFERER'),
40                     strings_only=True,
41                     errors='replace'
42                 )
43                 if referer is None:
44                     return self._reject(request, REASON_NO_REFERER)　　　　　　# 问题就出在这里　　
45
46                 good_referer = 'https://%s/' % request.get_host()
47                 if not same_origin(referer, good_referer):
48                     reason = REASON_BAD_REFERER % (referer, good_referer)
49                     return self._reject(request, reason)
50
51             if csrf_token is None:
52                 return self._reject(request, REASON_NO_CSRF_COOKIE)
53             request_csrf_token = ""
54             if request.method == "POST":
55                 try:
56                     request_csrf_token = request.POST.get('csrfmiddlewaretoken', '')
57                 except IOError:
58                     pass
59
60             if request_csrf_token == "":
61                 request_csrf_token = request.META.get('HTTP_X_CSRFTOKEN', '')
62
63             if not constant_time_compare(request_csrf_token, csrf_token):
64                 return self._reject(request, REASON_BAD_TOKEN)
65
66         return self._accept(request)