django.request: Forbidden (Referer checking failed - no Referer.) - django

Question

I am developing a web application using AWS, and Django Rest Framework.(Django:v1.8, DRF:v3)
I have kept getting django.request: Forbidden (Referer checking failed - no Referer.) for POST multipart form request.
I am using AWS ELB(Elastic load balancer), NGINX on my ec2(in autoscailing group) and Gunicorn.
AWS ELB listener setting is like below(HTTPS only):
elb https only listener setting
NGINX setting is like below:
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
include /etc/nginx/conf.d/*.conf;
index index.html index.htm;
upstream my_server {
server localhost:8000;
}
server {
listen 80;
server_name <server name>;
access_log /etc/nginx/log/local-wc.access.log;
error_log /etc/nginx/log/local-wc.error.log;
root /usr/share/nginx/html;
location /api/v1 {
proxy_pass http://my_server/api/v1;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Protocol $scheme;
}
}
}
<server name> is the CNAME which point to elb DNS name.
In other words, <server name> => xxxx-123456789.us-west-2.elb.amazonaws.com (A Record).
Every API call is made by https://<server name>/api/v1/*
Finally Gunicorn is running by:
gunicorn my_django_app.wsgi:application -w 1 -b 127.0.0.1:8000 -t 300 --max-requests=100
and Django Setting is:
ALLOWED_HOSTS = ['*']
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
MIDDLEWARE_CLASSES = (
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.common.CommonMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.auth.middleware.SessionAuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
'django.middleware.security.SecurityMiddleware',
)
View function is like below(with CSRF exempt):
class UserViewSet(CsrfExemptMixin, mixins.CreateModelMixin,
mixins.ListModelMixin,
mixins.RetrieveModelMixin,
mixins.UpdateModelMixin,
viewsets.GenericViewSet):
# already tried #csrf_exempt
def create(self, request, *args, **kwargs):
self.parser_classes = (FormParser, MultiPartParser, )
.........
Problem again:
When I send
curl -i -k -X POST -H "Accept: application/json" \
-F "email=myemail#email.com" \
-F "profile_img=#profile.jpg" \
https://<server name>/api/v1/users/
and in my Django log:
[WARNING] django.request: Forbidden (Referer checking failed - no Referer.): /api/v1/users/
It worked with POST on HTTP or GET method on HTTPS.
I wonder whether ELB configuration is wrong or Nginx Configuration is wrong with referer...
I would appreciate if some one help me to solve this problem..

Answer 1

I think DRF ignores csrf_exempt decorator and I am not sure where the CsrfExemptMixin is defined. The easiest thing you can do is add Referrer: yourhost to your curl headers.