1

My site works fine locally, but on the staging server, I get the following error:

"Referer checking failed - Referer is insecure while host is secure."

Settings files are identical in both environments. Possibly should not be, but I'm not sure what needs to be tweaked.

The only other question I can find about this issue is CSRF verification Failed - Referer is insecure while host is secure, but that seems to have the opposite problem (works on production, but not locally).

I've looked at https://github.com/django/django/blob/master/django/middleware/csrf.py, but it's not immediately helpful to me.

This is where I make the POST request:

$(function() {
    $(".submit-signin").on("click", function() {
        var data = $("#signin-form").serialize();
        $.post("/signin/", data, function(response) {
        });
    });
});

data contains the csrf token:

<form id="signin-form">
      <input type="hidden" name="csrfmiddlewaretoken" value="{{ csrf_token }}"/>
      {% include "signin_form.html" %}
      <button type="button" class="small-button submit-signin">Sign in</button>
</form>

I don't know if the staging server is using HTTPS. How can I find this out?

Community
  • 1
  • 1
ballardjw2
  • 27
  • 1
  • 6
  • 1
    Please show us the code that you are using to send/generate the POST request. Also is your staging server using HTTPS? – solarissmoke Aug 20 '16 at 03:38
  • Question updated with code. I don't know if the staging server is using HTTPS... – ballardjw2 Aug 22 '16 at 15:35
  • 2
    For people finding this question years later, the OPs error is common if you're making ajax/xhr requests from a HTTP site to a HTTPS server. The Django csrf middleware will not accept that the referrer is insecure. There is no setting or option in the csrf middleware to disable this checking. BUT the Django CORS middleware (which you're likely also using) has a setting to deal with this exact situation. CORS_REPLACE_HTTPS_REFERER = True That causes the cors middleware alters (fakes) the http scheme, tricking the csrf middleware to work. – Jagu Jan 29 '19 at 10:16

0 Answers0