3

I'm trying to use an iframe of my django site in a different domain, however whenever I submit a form, It says the CSRF cookies is not set. This occurs in chrome and safari. I am running Django 3.1.0.

I've tried adding the following settings in my settings.py:

SESSION_COOKIE_SAMESITE = 'None'
SESSION_COOKIE_SECURE = True
X_FRAME_OPTIONS = 'ALLOWALL'
CORS_ORIGIN_ALLOW_ALL = True
CORS_ALLOW_CREDENTIALS = True
CSRF_COOKIE_SECURE = False
CSRF_COOKIE_SAMESITE = None
CSRF_COOKIE_HTTPONLY = False
CSRF_TRUSTED_ORIGINS = [
    'otherdomain.com',
]
MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
    'corsheaders.middleware.CorsMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
]

Further, I can confirm the csrf token is being set in the form using:

{% csrf_token %}

Lastly, I've also added the @xframe_options_exempt decorator to the form page.

Edit: I am also using the render method to display the form as recommended by the documentation.

Edit2: For some more context, this form functions fine when it is used in the host domain (not an iframe)

Unfortunately the csrf exempt decorator is not an option for me. I've tried clearing my cookies, though it does not solve my problem. Any help would be greatly appreciated!

Mohammed Sarnow
  • 61
  • 4

1 Answers1

2

This was solved by changing the value of CSRF_COOKIE_SAMESITE to 'None' instead of None. Apparently Chrome requires it to be an explicit string, not an empty value

Mohammed Sarnow
  • 61
  • 4