Production only: sometimes get 403 CSRF verification failed

Question

I have a login form that logs the users into the admin site. It works fine in development, and mostly works fine in production, but sometimes it gives a 403 CSRF verification failed error. Note that this happens to users that were able to log in before, so I can't imagine it's an issue with their browser.

It looks like jenniwren had a similar issue in this comment. They never asked a question about it, and the other commenters had no clue why that would happen.

Here's what I have:

urls.py

urlpatterns += patterns('django.contrib.auth.views',
    url(r'^logout$', 'logout', {'next_page': 'mysite_login'}, name='mysite_logout'),
    url(r'^login$', 'login', name='mysite_login'),

    url('^', include('django.contrib.auth.urls')),
)

main/registration/login.html

{% extends "base.html" %}
{% load staticfiles %}

{% block content %}
    {% if form.errors and not form.non_field_errors %}
        <p class="errornote">Please correct the error(s) below.</p>
    {% endif %}

    {% if form.non_field_errors %}
        {% for error in form.non_field_errors %}
            <p class="errornote">
                {{ error }}
            </p>
        {% endfor %}
    {% endif %}

    <form action="{{ app_path }}" method="post" id="login-form">
        {% csrf_token %}

        <div class="form-row">
            {% if form.errors %}
                { form.username.errors }}
            {% endif %}
            {{ form.username.label_tag }}
            {{ form.username }}
        </div>
        <div class="form-row">
            {% if form.errors %}
                {{ form.password.errors }}
            {% endif %}
            {{ form.password.label_tag }}
            {{ form.password }}
        </div>
        <input type="hidden" name="next" value="{{ next }}" />

        <div class="submit-row">
            <input type="submit" value="Log in" />
        </div>

        <div class="password-reset-link">
            <a href="{% url 'password_reset' %}">Forgot your password?</a>
        </div>
    </form>
{% endblock content %}

settings.py

INSTALLED_APPS = (
    'filebrowser',
    'grappelli',
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'psycopg2',
    'main',
    'mysite'
)

MIDDLEWARE_CLASSES = (
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.auth.middleware.SessionAuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
    'django.middleware.security.SecurityMiddleware'
)

SECURE_CONTENT_TYPE_NOSNIFF = True
SECURE_BROWSER_XSS_FILTER = True
CSRF_COOKIE_HTTPONLY = True

Udi · Answer 1 · 2020-10-16T05:40:48.287

3

This problem might occur if:

A user opens the login page in two different tabs
A user logins in one tab.
A user tries to login again in a different tab (although he is already logged in).

If your CSRF_FAILURE_VIEW shows your site template, you might be able to let the users know they are already logged in, and do not need to refresh the page.

edited Oct 16 '20 at 05:40

answered Mar 19 '17 at 11:23

Udi

29,222
9
96
129

score 1 · Answer 2 · answered Oct 15 '20 at 15:50

1

This is a message I got whed Debug=True:

The form has a valid CSRF token. After logging in in another browser tab or hitting the back button after a login, you may need to reload the page with the form, because the token is rotated after a login.

answered Oct 15 '20 at 15:50

orlyohreally

410
6
19

score 0 · Answer 3 · answered Apr 13 '20 at 07:32

0

I think this answer will help you, you can also use @csrf_exempt annotation over your function(view) like this:

@csrf_exempt
def foo():
   return 'bar'

django doc on this subject: https://docs.djangoproject.com/en/3.0/ref/csrf/

answered Apr 13 '20 at 07:32

A Khalili

192
2
10

score 0 · Answer 4 · answered Oct 07 '21 at 16:10

0

I was doing some proxying for the admin url and fixed my issue by editing my settings.py file and adding:

CSRF_TRUSTED_ORIGINS = [".subdomain.com"]

Using my organisation's gsuite subdomain. See the django docs for reference

answered Oct 07 '21 at 16:10

Matthew Kaye

69
3

Production only: sometimes get 403 CSRF verification failed

4 Answers4