Commit 97e4f73d by Simon Chen

Add cache bust Querystring to get the CSRF token

parent adc85c50
import random
import string
import requests import requests
from django.utils.functional import cached_property from django.utils.functional import cached_property
from stdimage.models import StdImageFieldFile from stdimage.models import StdImageFieldFile
...@@ -100,20 +103,32 @@ class MarketingSiteAPIClient(object): ...@@ -100,20 +103,32 @@ class MarketingSiteAPIClient(object):
# This is not a RESTful API so checking the status code is not enough # This is not a RESTful API so checking the status code is not enough
# We also check that we were redirected to the admin page # We also check that we were redirected to the admin page
if not (response.status_code == 200 and response.url == admin_url): if not (response.status_code == 200 and response.url == admin_url):
raise MarketingSiteAPIClientException('Marketing Site Login failed!') raise MarketingSiteAPIClientException(
{
'message': 'Marketing Site Login failed!',
'status': response.status_code,
'url': response.url
}
)
return session return session
@cached_property @property
def api_session(self): def api_session(self):
self.init_session.headers.update(self.headers) self.init_session.headers.update(self.headers)
return self.init_session return self.init_session
@cached_property @property
def csrf_token(self): def csrf_token(self):
token_url = '{root}/restws/session/token'.format(root=self.api_url) # We need to make sure we can bypass the Varnish cache.
# So adding a random salt into the query string to cache bust
random_qs = ''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(10))
token_url = '{root}/restws/session/token?cachebust={qs}'.format(root=self.api_url, qs=random_qs)
response = self.init_session.get(token_url) response = self.init_session.get(token_url)
if not response.status_code == 200: if not response.status_code == 200:
raise MarketingSiteAPIClientException('Failed to retrieve Marketing Site CSRF token!') raise MarketingSiteAPIClientException({
'message': 'Failed to retrieve Marketing Site CSRF token!',
'status': response.status_code,
})
token = response.content.decode('utf8') token = response.content.decode('utf8')
return token return token
...@@ -127,7 +142,7 @@ class MarketingSiteAPIClient(object): ...@@ -127,7 +142,7 @@ class MarketingSiteAPIClient(object):
user_id = response.json()['list'][0]['uid'] user_id = response.json()['list'][0]['uid']
return user_id return user_id
@cached_property @property
def headers(self): def headers(self):
return { return {
'Content-Type': 'application/json', 'Content-Type': 'application/json',
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment