I moved applications to the production server and I have a problem with CSRF - Access denied (403)
CSRF verification failed. The request was aborted.
I checked in my browser and I don't have a cookie named
csrftoken
Part of my settings.py looks like this:
SECRET_KEY = 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
SESSION_COOKIE_SECURE = True SESSION_COOKIE_SAMESITE = None
CSRF_COOKIE_SECURE = True CSRF_COOKIE_SAMESITE = 'Strict'
#SECURE_HSTS_SECONDS = 31536000
#SECURE_CONTENT_TYPE_NOSNIFF = True
#CSRF_COOKIE_SECURE = True
#SESSION_COOKIE_SECURE = True
#SESSION_COOKIE_SAMESITE = None
#SECURE_HSTS_PRELOAD = True
I haven't turned on HTTPS yet
Everything worked fine on the development server.
Where to find the cause and what to improve?
problem solved.
You just had to generate an SSL certificate and enable HTTPS.
This post showed me the solution Django: Forbidden (CSRF cookie not set.)
What solved it for me was to add the following to settings.py, replacing "<my_domain>" part of course.
CSRF_TRUSTED_ORIGINS = ['https://<my_domain>.com']
This code above works like magic
Related
Been working on my live server all day and just got it working, admin was working fine, i cleared cookies and suddenly i got the following error, and no fixes seem to be helping me. My website does have SSL yet so its still http(dont know if this has anything to do with it?)
DEBUG = False
CSRF_TRUSTED_ORIGINS = ['http://.*', 'http://example.com', 'http://www.example.com']
# HTTPS Settings
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = False
SECURE_SSL_REDIRECT = False
# HSTS Settings
SECURE_HSTS_SECONDS = 31536000
SECURE_HSTS_PRELOAD = True
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
This is the only form on my website that requires csrf_token and as you can see it already has it.
SOLVED
By adding the ip from my domain to the allowed hosts and trusted origins.
Do you have CsrfViewMiddleware in your MIDDLEWARE_CLASSES setting? Are you accessing the site non-securely (seems so) then it could not work. Try to disable CSRF_COOKIE_SECURE, CSRF_COOKIE_HTTPONLY and SESSION_COOKIE_SECURE and you will see it will work.
I am trying to launch my application which was written using django 1.6.5 version, in a salesforce webtab iframe. I was getting a "CSRF cookie not set" error while trying to login. I understood through the console logs that in the latest version of Chrome, only allows the cookies which are set with 'secure'=True and samesite=None. I understood that these settings can be added in the settings.py in later versions of django
SESSION_COOKIE_SAMESITE = 'None'
CSRF_COOKIE_SAMESITE = 'None'
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
But this does not work in django 1.6.5 version. I have been trying to find out how to apply these settings in my version.
There is no support to add the samesite setting in Django 1.6.5, that is the reason the adding those in the settings.py did not work. Django 3.1 is where they started this support this setting. I tried adding my own middleware and add the setting to the cookies, but I got an invalid field error. Then I found a library I can use for this - django-cookies-samesite. I was able to apply the samesite setting to None and the secure to True, then I was able to login through salesforce web tab.
Add these in settings.py
SESSION_COOKIE_SAMESITE = 'None'
SESSION_COOKIE_SAMESITE_FORCE_ALL = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
And add this in the MIDDLEWARE_CLASSES:
'django_cookies_samesite.middleware.CookiesSameSite',
Relevant sites I got the info from:
https://github.com/django/django/pull/8380/files
https://pypi.org/project/django-cookies-samesite/
I'm trying to configure my site to pass the tests at:
https://observatory.mozilla.org
https://csp-evaluator.withgoogle.com/
I've been looking at this blog post. I'm using the Django app called django-csp to implement this. My Django settings in production are as follows:
# Content Security Policy
CSP_DEFAULT_SRC = ("'none'", )
CSP_STYLE_SRC = ("'self'", "fonts.googleapis.com", "'sha256-/3kWSXHts8LrwfemLzY9W0tOv5I4eLIhrf0pT8cU0WI='")
CSP_SCRIPT_SRC = ("'self'", )
CSP_IMG_SRC = ("'self'",)
CSP_FONT_SRC = ("'self'", "fonts.gstatic.com")
CSP_CONNECT_SRC = ("'self'", )
CSP_OBJECT_SRC = ("'none'", )
CSP_BASE_URI = ("'none'", )
CSP_FRAME_ANCESTORS = ("'self'", 'https://example.com/', 'https://example.com/')
CSP_FORM_ACTION = ("'self'", )
CSP_INCLUDE_NONCE_IN = ('script-src',)
CSRF_COOKIE_SECURE = True
SESSION_COOKIE_SECURE = True
SECURE_CONTENT_TYPE_NOSNIFF = True
SECURE_BROWSER_XSS_FILTER = True
SECURE_SSL_REDIRECT = True
X_FRAME_OPTIONS = 'DENY'
SECURE_HSTS_SECONDS = 60
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True
Yet, when I run the aforementioned tests I fail even though I have the above setup. Moreover, in Chrome dev tools I receive no errors, which is great.
Anyone have advice on this please?
Thanks
Update:
I'm deploying the app via Heroku. When I test the appname.herokuapp.com url with Mozilla Observatory, I pass all the tests.
It seems that when I forward the domain appname.herokuapp.com to mywebsite.com, some settings are skipped? I failed the tests with mywebsite.com
I have added the CNAME www to be the value of the custom Heroku DNS.
Indeed, my issue was in the way I had configured my DNS settings. I kept my Django prodution settings as is (see above).
I added a custom domain in my Heroku settings and used the auto-generated server name in my CNAME settings in Cloudflare.
Then I ran a check in Mozilla Observatory and passed the tests.
I'm experimenting with an app running on Angular 2 in the frontend and Django as API and I can't access the CSRF cookie sent from Django.
As you can see, I am getting back the cookie from the server but I cannot access it from the browser (document.cookie) or Angular 2 (using the ng2-cookies module).
Everything was working while testing on localhost, now client and server are running on different hosts and this might be the reason of the problem.
Client running on https://django-angular2-movies.firebaseapp.com/
Server running on https://glacial-shore-18891.herokuapp.com
This is part of the settings I'm using on Django:
settings.py
CORS_ORIGIN_ALLOW_ALL = True
CORS_ALLOW_CREDENTIALS = True
CSRF_COOKIE_SECURE = False
CSRF_TRUSTED_ORIGINS = ['django-angular2-movies.firebaseapp.com']
ALLOWED_HOSTS = ['*']
Other things that I have tried, but didn't help:
Removing the CSRF_TRUSTED_ORIGINS setting
Adding CSRF_COOKIE_DOMAIN = 'django-angular2-movies.firebaseapp.com'
Using { withCredentials: true } in the request sent from the client
Using the #ensure_csrf_cookie decorator on Django views
What am I doing wrong?
Thanks
I'm testing my django (1.6.5) app in localhost. I use django-allauth and without ssl everything was ok.
I installed django-sslserver and change as follows:
Settings.py
ACCOUNT_DEFAULT_HTTP_PROTOCOL = 'https' # allauth
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
os.environ['HTTPS'] = "on"
Api Google Console
REDIRECT URIS : http://localhost:8000/accounts/google/login/callback/
https://localhost:8000/accounts/google/login/callback/
When I logged in with my google account, I accepted the authorization, but when it's redirected back to my app, shows the error:
DoesNotExist at /accounts/google/login/callback/
User matching query does not exist.
Request URL: https://localhost:8000/accounts/google/login/callback/?state=PwKj3DsvzmNp&code=4/16ttwvGn7SIZKyHWZ9sSy8YOx7sg.4t9M4AcGcoEfoiIBeO6P2m9E6KmpkAI
allauth/socialaccount/helpers.py in _login_social_account
def _login_social_account(request, sociallogin):
**return perform_login(request, sociallogin.account.user, ...**
email_verification=app_settings.EMAIL_VERIFICATION,
redirect_url=sociallogin.get_redirect_url(request),
signal_kwargs={"sociallogin": sociallogin})
The error is in the return line.
Can you help me? Thanks! :)