CSRF verification failed. Request aborted. only for login page

Question

I am creating a To-Do application as my first project in django. Everything works fine when I run on local server but when I deploy it to heroku, CSRF token is not working on login page only. The app is deployed here.

Issue: If we try any random or existing user on the login page, it shows CSRF verification failed BUT if we open /register endpoint i.e. Register a user on the app, it creates user and logs in to that user correctly at them time. Whole app features like adding a new task, editing a task, deleting a task works fine until I logout that user.

When I come back to the login page again, I am not able to login with any user account.

I've tried a lot of different methods like services in Procfile, environment variables for SECRET_KEY, providing meta tag in the main.html for csrf token using content={{ csrf_token }} but no luck.

Codes:

settings.py

# SECURITY WARNING: keep the secret key used in production secret!
SECRET_KEY = os.environ.get('SECRET_KEY')

# SECURITY WARNING: don't run with debug turned on in production!
DEBUG = os.getenv('DEBUG', False)

ALLOWED_HOSTS = [
    '.herokuapp.com',
    '127.0.0.1:8000'
]

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'whitenoise.middleware.WhiteNoiseMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    #'django.middleware.csrf.CsrfViewMiddleware', Commented or not commented, it doesn't matter... issue still persists
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

views.py for login and register page

class CustomLoginView(LoginView):
    template_name = 'app/login.html'
    fields = '__all__'
    redirect_authenticated_user = True

    def get_success_url(self):
        return reverse_lazy('tasks')


class RegisterView(FormView):
    template_name = 'app/register.html'
    form_class = UserCreationForm
    success_url = reverse_lazy('login')

    def form_valid(self, form):
        user = form.save()
        if user is not None:
            login(self.request, user)
        return super(RegisterView, self).form_valid(form)

    def get(self, *args, **kwargs):
        if self.request.user.is_authenticated:
            return redirect('tasks')
        return super(RegisterView, self).get(*args, **kwargs)

main.html


{% load static %}

  
    
    
    

    
    
    
    

    

    

    To Do Tasks
  

  
    {% block content %} {% endblock %}

login.html

{% extends 'app/main.html' %} {% block content %}


  Login



  
    {% csrf_token %}
    {{ form.as_p }}
    
  

  Don't have an account? Register


{% endblock content %}

register.html

{% extends 'app/main.html' %} {% block content %}


  Register



  
    {% csrf_token %}

     {{ form.username.label }} * 
    {{ form.username }}
    
      150 characters or fewer.
      Letters, digits and @ - + _ . only.
    

     {{ form.password1.label }} 
    {{ form.password1 }} {{ form.password1.help_text }}

     Confirm Password 
    {{ form.password2 }} 

    {{ form.password2.help_text }}

    
  

  Already have an account? Login

{% endblock content %}

task.html (where it is supposed to land after successful login)

{% extends 'app/main.html' %} {% block content %}


  
    Hello {{ request.user|capfirst }}
    
      You have {{ count }} incomplete task{{ count|pluralize:"s" }}.
    
  
  {% if request.user.is_authenticated %}
  Logout
  {% endif %}



  
    
    
  

  +



  {% for task in tasks %}

  
    {% if task.complete %}

    
      
      
         {{ task|capfirst }} 
      
    
    
      

      ×
    

    {% else %}

    
      
      {{ task|capfirst }}
    
    
      

      ×
    

    {% endif %}
  

  {% empty %}
  No task found.
  {% endfor %}


{% endblock content %}

user_16854737 · Answer

I never used DEBUG=True before posting this question and the error was clearly visible after using that.

Error:

Origin checking failed - https://hemant-to-do.herokuapp.com does not match any trusted origins.

Solution:

added following to settings.py

CSRF_TRUSTED_ORIGINS = [
    'https://hemant-to-do.herokuapp.com'
]

CSRF verification failed. Request aborted. only for login page

1 Answers