Ignore XSRF cookie check when X-Requested-With XMLHttpRequest header is present

diff --git a/tornado/web.py b/tornado/web.py
index 7b8dd7d0947a49ac30947e031a5193f578b18df2..86aa1f3405f11db6d567cdce5a471dd69408d61f 100644 (file)
--- a/tornado/web.py
+++ b/tornado/web.py
@@ -590,6 +590,8 @@ class RequestHandler(object):
 
         See http://en.wikipedia.org/wiki/Cross-site_request_forgery
         """
+        if self.request.headers.get("X-Requested-With") == "XMLHttpRequest":
+            return
         token = self.get_argument("_xsrf", None)
         if not token:
             raise HTTPError(403, "'_xsrf' argument missing from POST")