Sets the X-CSRFToken header for every jQuery ajax non-GET request to make CSRF protection easy. This fixes the example from Django docs here: https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#ajax

ajax_setup.js

$.ajaxSetup({
    beforeSend: function(xhr, settings) {
        if (settings.type == 'POST' || settings.type == 'PUT' || settings.type == 'DELETE') {
            function getCookie(name) {
                var cookieValue = null;
                if (document.cookie && document.cookie != '') {
                    var cookies = document.cookie.split(';');
                    for (var i = 0; i < cookies.length; i++) {
                        var cookie = jQuery.trim(cookies[i]);
                        // Does this cookie string begin with the name we want?
                        if (cookie.substring(0, name.length + 1) == (name + '=')) {
                            cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
                            break;
                        }
                    }
                }
                return cookieValue;
            }
            if (!(/^http:.*/.test(settings.url) || /^https:.*/.test(settings.url))) {
                // Only send the token to relative URLs i.e. locally.
                xhr.setRequestHeader("X-CSRFToken", getCookie('csrftoken'));
            }
        }
    }
});

Very nice gist, thanks for sharing! However, I had to modify the name of the cookie for it to work with Tornado version 4.5.1. It seems that the name of the cookie is now '_xsrf' instead of 'csrftoken'.

Thank you!

<3

Sooooo many thanks!

Hi,

Why does getCookie function is declared within conditional? Is it about concurrency?
Thanks,

Carlos.

please explain implementation