5
votes

Most of the SO answers are asking to clear cookies and confirm middleware class. I have already tried that.

Python - 3.4
Django - 1.10
Using VirtualEnv.

I am getting Forbidden (403) CSRF verification failed. Request aborted. error on Django admin login screen. I have hosted my site on pythonanywhere.com with django version 1.9.

  • I have cleared the browser cookies. All of them.
  • I reloaded the login screen. Get request.
  • In browser cookies, which were empty till now, one value has been set for my website, where csrf value is = XPp5hAhylAkt27U4SzGPNU7w8SFBJ3RP enter image description here
  • In response header, set cookies was send with cookies value = UT24544MghHLZi0IrGHQlCcpk1v0SbCy . Same value was available in form's source code. enter image description here
  • Now I entered the username and password and click on login button.
  • Received the 403 error CSRF verification failed. Request aborted.
  • I rechecked all the values of csrf token.
  • In request header CSRF cookies values = XPp5hAhylAkt27U4SzGPNU7w8SFBJ3RP enter image description here
  • In form data csrf values = UT24544MghHLZi0IrGHQlCcpk1v0SbCy enter image description here

  • I already have 'django.middleware.csrf.CsrfViewMiddleware', in middleware classes. I cleared browser cache and cookies. Even restarted the system.

I have used exactly same code on different site where it is working perfectly fine.

Why there are different csrf-token values? What is the solution to this problem?

update 1: If I set debug = False in settings, it works fine. But I cant keep it as code is live.

update 2: Upon further investigation I found out that somehow browser cookie csrftoken's value is not being set to correct value which is being passed in response header. If I delete and the cookie from browser and then set it to correct value from console, post requests work.

update 3 : Now same issue is happening with every post request or form submission I am doing on my web app. CSRF token value sent in response header and source code is not same as the one being set in browser cookies.

update 4: Setting CSRF_COOKIE_NAME = "csrf_token" also didn't helped.

1
Are you actually putting the CSRF token into your form?Glenn
Hi Glen, this is admin module, so any form created inside admin module must have csrf token.Anurag Rana
Did you set CSRF_COOKIE_SECURE to True perhaps ?zxzak
@zxzak : No I didn't. and default is false.Anurag Rana
Read All About {{ csrf_token }} docs.djangoproject.com/en/1.10/ref/csrfJody Fitzpatrick

1 Answers

10
votes

The unexpected value for the CSRF token is set when the browser tries to fetch the favicon.

The URL you have defined for your favicon seems to be invalid, and apparently, non-existing URLs are handled by your default view. This sets a different CSRF cookie, but the page that is displayed in the browser still has the initial CSRF token in the form.

Request loading the page: enter image description here

Request loading the favicon: enter image description here

You can fix this particular error by ensuring that the favicon exists.

Note this this bug will come back whenever any resource you link (e.g. an image) does not exist because your app renders the homepage instead of returning a 404 error.