blocks|key|1212783|text|如果您的表单位于iframe内，则原因可能是IE默认的阻止第三方cookie的策略。你可以|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1212784|1212785|不使用iframe，|unordered-list-item|1212786|将带有iframe的页面放在与主页相同的域下，|1212787|使用@csrf_exempt+decorator为特定表单禁用CSRF，或者|offset|length|1212788|使用HTTP头告诉浏览器允许第三方cookie(请参见Chase+Seibert's+excellent+explanation+of+this+issue).|1212789|中的变通方法#3|1212790|Django的ticket+#17157建议在文档中添加关于此问题的注释。|1212791|entityMap|0|LINK|mutability|MUTABLE|url|https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#django.views.decorators.csrf.csrf_exempt|1|http://bitkickers.blogspot.com/2011/06/django-csrf-verification-failed-in-ie.html|2|https://code.djangoproject.com/ticket/17157^0|0|0|0|0|2|M|0|0|R|1F|1|0|0|E|6|2|0^^$0|@$1|2|3|4|5|6|7|13|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|14|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|15|8|@]|9|@]|A|$]]|$1|F|3|G|5|E|7|16|8|@]|9|@]|A|$]]|$1|H|3|I|5|E|7|17|8|@]|9|@$J|18|K|19|1|1A]]|A|$]]|$1|L|3|M|5|E|7|1B|8|@]|9|@$J|1C|K|1D|1|1E]]|A|$]]|$1|N|3|O|5|6|7|1F|8|@]|9|@]|A|$]]|$1|P|3|Q|5|6|7|1G|8|@]|9|@$J|1H|K|1I|1|1J]]|A|$]]|$1|R|3|-4|5|6|7|1K|8|@]|9|@]|A|$]]]|S|$T|$5|U|V|W|A|$X|Y]]|Z|$5|U|V|W|A|$X|10]]|11|$5|U|V|W|A|$X|12]]]]

If your form is inside an iframe, the probable reason is IE's default policy of blocking third-party cookies. You could

<ul>
<li>not use an iframe,</li>
<li>bring the iframed page under the same domain as the main page,</li>
<li>disable CSRF for that particular form using the <a href="https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#django.views.decorators.csrf.csrf_exempt" rel="nofollow">@csrf_exempt decorator</a>, or</li>
<li>use HTTP headers to tell the browser to allow third-party cookies (see work-around #3 in <a href="http://bitkickers.blogspot.com/2011/06/django-csrf-verification-failed-in-ie.html" rel="nofollow">Chase Seibert's excellent explanation of this issue</a>).</li>
</ul>

Django's ticket <a href="https://code.djangoproject.com/ticket/17157" rel="nofollow">#17157</a> proposes to add a note about this issue in the documentation.

blocks|key|1380256|text|我也有同样的问题，我的问题是我没有指定表单操作属性。IE显然不允许这样做。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1380257|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

I had the same problem, the problem for me was that I did not specify the form action attribute. IE apparantly doesn't allow that.

blocks|key|1014842|text|在Django的标签#17157+(感谢@akaihola提供的链接)中指出，问题在于Internet+Explorer默认阻止第三方cookie。因此，您可以在浏览器设置中为所有站点或仅为您的站点启用第三方cookies。以下是如何在IE+7(来自this+link)中做到这一点：|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1014843|隐私单击"Tools“菜单，然后单击"Internet+Options"|1014844|Select+|unordered-list-item|1014845|”|ordered-list-item|1014846|1014847|1014848|1014849|选项1:为所有站点启用第三方cookie|1014850|单击"Third-party+cookie“下的"Override+automatic+cookie+handling"|1014851|Select+|1014852|”按钮，然后单击"OK"|1014853|1014854|1014855|或|1014856|选项2:仅为Feedjit.com启用第三方cookies|1014857|Cookie单击“Sites”|1014858|添加“|1014859|-domain.com”并单击“OK”|1014860|选择“第三方Cookie”下的"Accept“按钮并单击"OK"|1014861|1014862|entityMap|0|LINK|mutability|MUTABLE|url|https://code.djangoproject.com/ticket/17157|1|http://feedjit.com/static/howToEnableThirdPartyCookies.html^0|A|6|0|3H|9|1|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|1|1|0^^$0|@$1|2|3|4|5|6|7|1L|8|@]|9|@$A|1M|B|1N|1|1O]|$A|1P|B|1Q|1|1R]]|C|$]]|$1|D|3|E|5|6|7|1S|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|1T|8|@]|9|@]|C|$]]|$1|I|3|J|5|K|7|1U|8|@]|9|@]|C|$]]|$1|L|3|-4|5|K|7|1V|8|@]|9|@]|C|$]]|$1|M|3|-4|5|6|7|1W|8|@]|9|@]|C|$]]|$1|N|3|-4|5|6|7|1X|8|@]|9|@]|C|$]]|$1|O|3|P|5|6|7|1Y|8|@]|9|@]|C|$]]|$1|Q|3|R|5|6|7|1Z|8|@]|9|@]|C|$]]|$1|S|3|T|5|H|7|20|8|@]|9|@]|C|$]]|$1|U|3|V|5|K|7|21|8|@]|9|@]|C|$]]|$1|W|3|-4|5|6|7|22|8|@]|9|@]|C|$]]|$1|X|3|-4|5|6|7|23|8|@]|9|@]|C|$]]|$1|Y|3|Z|5|6|7|24|8|@]|9|@]|C|$]]|$1|10|3|11|5|6|7|25|8|@]|9|@]|C|$]]|$1|12|3|13|5|6|7|26|8|@]|9|@]|C|$]]|$1|14|3|15|5|K|7|27|8|@]|9|@]|C|$]]|$1|16|3|17|5|6|7|28|8|@]|9|@]|C|$]]|$1|18|3|19|5|K|7|29|8|@]|9|@]|C|$]]|$1|1A|3|-4|5|6|7|2A|8|@]|9|@]|C|$]]|$1|1B|3|-4|5|6|7|2B|8|@]|9|@]|C|$]]]|1C|$1D|$5|1E|1F|1G|C|$1H|1I]]|1J|$5|1E|1F|1G|C|$1H|1K]]]]

In Django's ticket <a href="https://code.djangoproject.com/ticket/17157" rel="nofollow">#17157</a> (thanks @akaihola for the link) it's stated that the problem is that Internet Explorer blocks third-party cookies by default. So you can enable third-party cookies for all sites or only for your site in browser settings.
Here is how to do that in IE 7 (from <a href="http://feedjit.com/static/howToEnableThirdPartyCookies.html" rel="nofollow">this link</a>):

<ol>
<li>Click the "Tools" menu</li>
<li>Click "Internet Options"</li>
<li>Select the "Privacy" tab</li>
</ol>

Option 1: To enable third-party cookies for all sites

<ol>
<li>Click "Advanced"</li>
<li>Select "Override automatic cookie handling"</li>
<li>Select the "Accept" button under "Third-party Cookies" and click "OK"</li>
</ol>

OR

Option 2: To enable third-party cookies just for Feedjit.com

<ol>
<li>Click "Sites"</li>
<li>Add "your-domain.com" and click "Allow"</li>
<li>Click "OK"</li>
<li>Select the "Accept" button under "Third-party Cookies" and click "OK"</li>
</ol>

I have set up CSRF as described in the <a href="https://docs.djangoproject.com/en/dev/ref/contrib/csrf/" rel="noreferrer">Django docs</a> (using Django 1.3). It works with FF and Safari, but on IE9 I get
<pre><code>&lt;div id=&quot;summary&quot;&gt;
&lt;h1&gt;Forbidden &lt;span&gt;(403)&lt;/span&gt;&lt;/h1&gt;
&lt;p&gt;CSRF verification failed. Request aborted.&lt;/p&gt;
&lt;/div&gt;
</code></pre>
In the response headers of the Ajax request I find
<pre><code>Set-Cookie csrftoken=8db3637951243ffb591e6b2d6998ed03; expires=Fri, 14-Sep-2012 08:01:52 GMT; Max-Age=31449600; Path=/
</code></pre>
It works in IE9 when using it in a normal Form (i.e. no Ajax involved).
I am using Django behind nginx/1.1.2.
Any hints what I am missing here?

CSRF verfication failed, but only with IE9

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我已经按照 (使用Django1.3)中的描述设置了CSRF。它适用于FF和Safari，但在IE9上我得到<div id="summary"><h1>Forbidden (403)</h1>CSRF verification failed. Request aborted.</...

问CSRF验证失败，但仅使用IE9
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问CSRF验证失败，但仅使用IE9EN