Comment on Django Security Releases IssuedComments−bryanh15yA bothersome change, especially for all those employing jQuery plugins that don't have a quick method to add the CSRF token to AJAX requests.I think I might just add @csrf_exempt, as long as we aren't changing vital info via the request...−nbpoole15yOut of curiosity, why doesn't hooking beforeSend (as suggested in the blog post) work?−bryanh15yI haven't had a chance to try it, but if it gracefully handles every jQuery plug-ins' use of the .ajax() method, I don't see why it wouldn't work.−Pewpewarrows15yThis is correct. So long as the plugins themselves are using jQuery's own $.ajax() method (or one of its derivatives that in turn call it), then anything in ajaxSetup will be reflected in those requests.
Comments
A bothersome change, especially for all those employing jQuery plugins that don't have a quick method to add the CSRF token to AJAX requests.
I think I might just add @csrf_exempt, as long as we aren't changing vital info via the request...
Out of curiosity, why doesn't hooking beforeSend (as suggested in the blog post) work?
I haven't had a chance to try it, but if it gracefully handles every jQuery plug-ins' use of the .ajax() method, I don't see why it wouldn't work.
This is correct. So long as the plugins themselves are using jQuery's own $.ajax() method (or one of its derivatives that in turn call it), then anything in ajaxSetup will be reflected in those requests.