Django, Secure Login with Ajax from Http page

Question

I log in users from a Http page via ajax. I'm making the request to a secure (https) page. My issue is that I'm not receiving a response because (I assume) my view function is returning an HttpResponse object to the https page (my user is still at http).

Here is the code

  @secure_required      
  def login_async(request):
      if request.method=='POST':
         email=request.POST.get('email', '')
          try:
            user=User.objects.get(email__exact=email)
            username=user.username

          except User.DoesNotExist:
             username=''

      password=request.POST.get('password', '')


      user=auth.authenticate(username=username, password=password)
      if user is not None:
        auth.login(request,user)
        user_status=1
        user_fname=user.first_name


       user_data=[{'user_status':user_status, 'user_fname':user_fname,'user_favorite':user_favorite,'flag_record':flag_record, 'message_sent':message_sent,'is_post_owner':is_post_owner}]
       json_data=json.dumps(user_data)
       response=HttpResponse()
       response['Content-Type']="text/javascript"
       response.write(json_data)
       return response  
     else:  
        user_data=[{'user_status':user_status}]
        json_data=json.dumps(user_data)
        response=HttpResponse()
        response['Content-Type']="text/javascript"
        response.write(json_data)
        return response 

  else:
    user_data=[{'user_status':"0"}]                         

           json_data=json.dumps(user_data)
        response=HttpResponse()
        response['Content-Type']="text/javascript"
        response.write(json_data)
        return response

Why not just make the whole page https, you ask? Good question. I was having some issues with making the Tweet Button https compatible.

Thanks

You should really fix indentation on paste of your code. Especially if it's PYTHON code. — rombarcz, Apr 26 '11 at 16:45
Hi romke, I mostly did fix it. Is there an easy indent fuctionality on with the SO editor? I haven't found it — Ben, Apr 26 '11 at 18:01

score 3 · Accepted Answer · edited May 23 '17 at 11:55

3

If you'd check what your browser is sending over the net you'd see that it's not POST as you wanted but OPTIONS request. It's caused because https XHTTPRequest (AJAX) from http page is treated same way as cross-domain, check jQuery: I get OPTIONS request instead of GET for answer on handling that.

And one more thing, whole:

json_data=json.dumps(user_data)
response=HttpResponse()
response['Content-Type']="text/javascript"
response.write(json_data)
return response

Could be replaced just by:

return HttpResponse(json.dumps(user_data), mimetype='text/javascript')

edited May 23 '17 at 11:55

Community

1
1

answered Apr 26 '11 at 13:12

rombarcz

1,604
13
19

thanks for the code simplification, I do appreciate that, but this didn't really answer my question at all. The code works, it's just pasting issues on SO. I checked the XMLHttpResponse and it was an empty Object. It's because I'm sending the form data from an http to an https resource, which then returns it to the https page (not the original http page) – Ben Apr 26 '11 at 16:18

Django, Secure Login with Ajax from Http page

1 Answers1

Linked