2

I have a working login template that does a post and looks like:

<form action="" method="post">
            {% csrf_token %}
              <br>
                  {{form.email}}
                 

              <div class="text-center">
                <button type="submit">Login</i></button>
              </div>

            </form>

My SSL settings look like:

ssl

SECURE_SSL_REDIRECT = False
SECURE_HSTS_SECONDS = 3600
SESSION_COOKIE_SECURE = False
SECURE_PROXY_SSL_HEADER = None
CSRF_COOKIE_SECURE = False

I made two changes. I switched to an aws ec2 elastic load balancer and from https to http.

Now I am getting an error:

Forbidden (403) CSRF verification failed. Request aborted.

You are seeing this message because this site requires a CSRF cookie when submitting forms. This cookie is required for security reasons, to ensure that your browser is not being hijacked by third parties.

If you have configured your browser to disable cookies, please re-enable them, at least for this site, or for 'same-origin' requests.

Does anyone know why this is occurring?

Community
  • 1
  • 1
Atma
  • 29,141
  • 56
  • 198
  • 299
  • 1
    Check the cookies you have stored for your site and what do you write in the CSRF field when you POST. – dukebody Jan 26 '18 at 20:32
  • Do the EC2 instances share a database? If not, and if a session is created in one database but served by another, the session won't match up to the CSRF token, and you'll get 403'd – Robert Townley Jan 26 '18 at 20:37

2 Answers2

1

I must have a stale cookie. When I go to Chrome incognito mode, all works as would expect with a 200 response.

Dharman
  • 30,962
  • 25
  • 85
  • 135
Atma
  • 29,141
  • 56
  • 198
  • 299
0

Forbidden (403) CSRF verification failed. Request aborted.

You are seeing this message because this site requires a CSRF cookie when submitting forms. This cookie is required for security reasons, to ensure that your browser is not being hijacked by third parties.

If you have configured your browser to disable cookies, please re-enable them, at least for this site, or for 'same-origin' requests.

More information is available with DEBUG=True.

Gowtham Chowdhry
  • 9
  • 1