#28143: CSRF token fails when Debug is disabled and a custom view is used for
handler404
---------------------------------------+------------------------
Reporter: antigaprime | Owner: nobody
Type: Bug | Status: new
Component: CSRF | Version: 1.11
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
---------------------------------------+------------------------
I have set a custom 404 view, which uses the render function and passes
context variables to the view:
{{{
def page_not_found(request, **kwargs):
lang = request.session['lang']
content_dict = get_all_db_content(lang, '{0}|{1}'.format('all', 'not-
found'))
variables = {
'content_text': content_dict,
'page_lang': "not-found-{0}".format(lang),
'page': 'not-found',
'page_description': get_field_db_content(lang,
'page_description_not_found'),
'page_title': get_field_db_content(lang, 'page_title_not_found'),
}
return render(request, '404.html', variables, status=404)
}}}
In `urls.py` I have the following:
{{{
# Project libs
import mainsite.views as tn_views
handler404 = tn_views.page_not_found
}}}
When `DEBUG` is set to `False`, custom 404 templates are used, and in
turn, this makes the csrf token validation for the Django Admin panel to
be rejected, with a `403` error: `CSRF verification failed. Request
aborted.`.
Sometimes, I can go back, refresh the page, and attempt a new login, which
will work, other times it will not.
Removing the custom 404 view from `urls.py`, or setting `DEBUG` to `True`
(obviously), fixes the Django admin failed csrf error.
Another interesting thing is that during some tests, using
`CSRF_USE_SESSIONS = True` and `CSRF_COOKIE_AGE = None` instead of
cookies would fix the Django admin csrf error, but would break all csrf
validations from the site's frontend.
----
Additional (relevant?) info:
Using Redis as a session cache.
Additional settings:
{{{
ALLOWED_HOSTS = [
'.mysite.com',
'.mysite.info',
]
if DEBUG:
ALLOWED_HOSTS.extend(['.mysite.dev'])
MIDDLEWARE = [
'django.middleware.cache.UpdateCacheMiddleware',
'django.middleware.security.SecurityMiddleware',
'django.middleware.gzip.GZipMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.common.CommonMiddleware',
'django.middleware.locale.LocaleMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
'django.middleware.clickjacking.XFrameOptionsMiddleware',
'django.middleware.cache.FetchFromCacheMiddleware',
'mainsite.middleware.Guid',
'mainsite.middleware.SiteLang',
]
TEMPLATES = [
{
'BACKEND': 'django.template.backends.django.DjangoTemplates',
'DIRS': [
os.path.join(BASE_DIR, '_templates'),
],
'APP_DIRS': True,
'OPTIONS': {
'context_processors': [
'django.template.context_processors.debug',
'django.template.context_processors.request',
'django.contrib.auth.context_processors.auth',
'django.contrib.messages.context_processors.messages',
'mainsite.context.site_variables',
'mainsite.context.sitelang',
],
},
},
]
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/28143>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/054.a27a6ea2935ce0ce5d4b3aee32cd1c96%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
