基于Python脚本实现Django用户登录登出功能遇登出失效问题

Hey there! Let's figure out why your logout functionality isn't working when sending POST requests via a Python script—since your login is already working, we're halfway there. Let's start with the most common issues and walk through fixes with code examples.

Common Reasons Logout Fails #

• Missing Session/Cookie Persistence: Django relies on session cookies to track authenticated users. If your script isn't saving and reusing the login session cookie, the logout request won't recognize you as an authenticated user.
• Incorrect CSRF Token Handling: Most Django POST endpoints require a valid CSRF token. If you're not including this (or using an outdated one) in your logout request, you'll get a 403 Forbidden error.
• Wrong Endpoint or HTTP Method: Double-check you're targeting the correct logout URL (e.g., /accounts/logout/ by default) and using the method your Django view expects (some custom views enforce POST only).

Step-by-Step Fix with Code #

The key here is using a requests.Session() object to automatically manage cookies, and properly fetching CSRF tokens for each POST request.

1. Setup Session & Login (Working as You Have) #

First, confirm your login uses a session to persist cookies:

import requests
from bs4 import BeautifulSoup

# Initialize a session to handle cookie persistence
session = requests.Session()

# Fetch login page to get CSRF token
login_url = "http://your-domain.com/accounts/login/"
login_page = session.get(login_url)
soup = BeautifulSoup(login_page.content, "html.parser")
csrf_token = soup.find("input", {"name": "csrfmiddlewaretoken"})["value"]

# Send login POST request
login_payload = {
    "username": "your-username",
    "password": "your-password",
    "csrfmiddlewaretoken": csrf_token
}
login_response = session.post(login_url, data=login_payload)

# Verify login success (you already do this)
print("Login successful:", session.cookies.get("sessionid") is not None)

2. Fix Logout Request #

Now, use the same session to send a valid logout request. You have two options depending on your Django setup:

Option A: POST Request (with CSRF Token)

If your logout view requires POST (e.g., custom LogoutView with restricted methods), fetch the logout page's CSRF token first:

logout_url = "http://your-domain.com/accounts/logout/"

# Fetch logout page to get fresh CSRF token
logout_page = session.get(logout_url)
soup = BeautifulSoup(logout_page.content, "html.parser")
logout_csrf_token = soup.find("input", {"name": "csrfmiddlewaretoken"})["value"]

# Send logout POST request
logout_payload = {"csrfmiddlewaretoken": logout_csrf_token}
logout_response = session.post(logout_url, data=logout_payload)

# Verify logout success
print("Logout successful:", session.cookies.get("sessionid") is None)

Option B: GET Request (Default Django Behavior)

Django's default LogoutView accepts GET requests by default. If you haven't modified this, you can simplify to:

logout_url = "http://your-domain.com/accounts/logout/"
logout_response = session.get(logout_url)

# Verify logout
print("Logout successful:", session.cookies.get("sessionid") is None)

Debugging Tips #

If it's still not working, try these:

• Check the response status code: print(logout_response.status_code) (403 = CSRF issue, 404 = wrong URL, 200 = success but maybe session not cleared?)
• Print the response text: print(logout_response.text) to see if Django returns an error message or form.
• Ensure your Django logout view is configured correctly: If using a custom view, make sure it's clearing the session (call request.session.flush()) and invalidating cookies.

内容的提问来源于stack exchange，提问作者Coolis