CSRF middleware conflicts with request.upload_handlers

[Curtis Maloney]

So I recently ran into the csrf/upload_handlers conflict as mentioned in
the not https://docs.djangoproject.com/en/1.8/topics/http/file-uploads/#id1

I'd like to propose an additional option to solve this -- a decorator to
mark a view as "ajax-only" ... so the CSRF middleware will _only_ check
the header for the value, and skip request.POST.

Of course, this sort of change should involve a serious consideration to
the security ramifications of such a change.

So please... weigh in, one and all :)

--
Curtis

[Collin Anderson]

Maybe @csrf_check_header_only? I usually put the token in POST for my ajax calls.

[Curtis Maloney]

Yeah... good name for it...

https://github.com/django/django/pull/5688

--

Curtis