mirror of
https://github.com/encode/django-rest-framework.git
synced 2025-02-16 19:41:06 +03:00
9c9ffb18f4
HTML responses generated by the Browsable API otherwise generate inconsistent ETAGs -- due to the presence of CSRF tokens in the response -- even when the API is read-only, (and as such when the response contains no resource-modifying forms, i.e. neither POST nor PUT forms, which might require the CSRF token). While the template was appropriately including CSRF tokens only within POST and PUT forms, its AJAX overlay included the CSRF token in *every* response, regardless of whether it would be needed. This change brings the logic of the `script` block into line with that of the rest of the template -- and such that read-only APIs (and really the Browsable API pages of *any* read-only resources) will not needlessly include the CSRF token, and will now be safely cachable -- by both back-end systems and by the user agent. |
||
|---|---|---|
| .. | ||
| admin | ||
| docs | ||
| filters | ||
| horizontal | ||
| inline | ||
| pagination | ||
| vertical | ||
| admin.html | ||
| api.html | ||
| base.html | ||
| login_base.html | ||
| login.html | ||
| raw_data_form.html | ||
| schema.js | ||