CSRF（Cross Site Request Forgery, 跨站请求伪造）

function csrfSafeMethod(method) {
            // these HTTP methods do notrequire CSRF protection
            return (/^(GET|HEAD|OPTIONS|TRACE)$/.test(method));
        }
        $.ajaxSetup({
            beforeSend: function(xhr, settings) {
                if (!csrfSafeMethod(settings.type) &&!this.crossDomain) {
                    xhr.setRequestHeader("X-CSRFToken",$.cookie("csrftoken"));
                }
            }
        });
注释：  这样就实现了当GET|HEAD|OPTIONS|TRACE这些方式请求的时候不需要提交csrftoken

/*!
 * jQuery Cookie Plugin v1.4.1
 * https://github.com/carhartl/jquery-cookie
 *
 * Copyright 2013Klaus Hartl
 *Released under the MIT license
 */(function (factory) {
    if (typeof define === 'function' &&define.amd) {
        //AMD
        define(['jquery'], factory);
    } else if (typeof exports === 'object') {
        //CommonJS
        factory(require('jquery'));
    } else{
        //Browser globals
        factory(jQuery);
    }
}(function ($) {

    var pluses = /+/g;

    function encode(s) {
        returnconfig.raw ? s : encodeURIComponent(s);
    }

    function decode(s) {
        returnconfig.raw ? s : decodeURIComponent(s);
    }

    function stringifyCookieValue(value) {
        returnencode(config.json ? JSON.stringify(value) : String(value));
    }

    function parseCookieValue(s) {
        if (s.indexOf('"') ===0) {
            // This isa quoted cookie as according to RFC2068, unescape...
            s = s.slice(1, -1).replace(/\"/g, '"').replace(/\\/g, '\');
}

        try{
            // Replace server-side written pluses with spaces.
            // If we can't decode the cookie, ignore it, it's unusable.
            // If we can't parse the cookie, ignore it, it's unusable.
            s = decodeURIComponent(s.replace(pluses, ' '));
            returnconfig.json ? JSON.parse(s) : s;
        } catch(e) {}
    }

    function read(s, converter) {
        var value =config.raw ? s : parseCookieValue(s);
        return$.isFunction(converter) ? converter(value) : value;
    }

    var config = $.cookie =function (key, value, options) {

        //Write

        if (value !== undefined &&!$.isFunction(value)) {
            options =$.extend({}, config.defaults, options);

            if (typeof options.expires === 'number') {
                var days = options.expires, t = options.expires =new Date();
                t.setTime(+t + days * 864e+5);
            }

            return (document.cookie =[
                encode(key), '=', stringifyCookieValue(value),
                options.expires ? '; expires=' + options.expires.toUTCString() : '', // use expires attribute, max-age is notsupported by IE
                options.path    ? '; path=' + options.path : '',
                options.domain  ? '; domain=' + options.domain : '',
                options.secure  ? '; secure' : ''].join(''));
        }

        //Read

        var result =key ? undefined : {};

        // To prevent the for loop inthe first place assign an empty array
        // incase there are no cookies at all. Also prevents odd result when
        //calling $.cookie().
        var cookies = document.cookie ? document.cookie.split('; ') : [];

        for (var i = 0, l = cookies.length; i < l; i++) {
            var parts = cookies[i].split('=');
            var name =decode(parts.shift());
            var cookie = parts.join('=');

            if (key && key ===name) {
                // If second argument (value) is a function it's a converter...
                result =read(cookie, value);
                break;
            }

            // Prevent storing a cookie that we couldn't decode.
            if (!key && (cookie = read(cookie)) !==undefined) {
                result[name] =cookie;
            }
        }

        returnresult;
    };

    config.defaults ={};

    $.removeCookie =function (key, options) {
        if ($.cookie(key) ===undefined) {
            returnfalse;
        }

        // Must notalter options, thus extending a fresh object...
        $.cookie(key, '', $.extend({}, options, { expires: -1}));
        return!$.cookie(key);
    };

}));
注释：html前端通过<script src="/static/plugins/bootstrap/js/bootstrap.js"></script>方式引入该插件