Django csrf token not refreshed after first login

Question

I have hosted a website at http://cognezic-dev.ap-south-1.elasticbeanstalk.com/login/. On closer inspection, the form has the same csrf token across page refreshes and browsers, which I suspect to be the cause of the issue,this works fine on the local django server.Dont know where this is being cached. I have added CSRF Middleware in the settings.py too. You can use the test credentials as username bismeet and password bis12345 for testing. I have also tried creating a custom middleware as follows:

from django.middleware.csrf import rotate_token, CsrfViewMiddleware
from django.utils.deprecation import MiddlewareMixin

class CSRFRefresh(CsrfViewMiddleware,MiddlewareMixin):
    def process_response(self, request, response):
        print("Custom MiddleWare called")
        rotate_token(request)
        return response

But it still fails.

My settings.py with custom middleware contains:

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
     'solvesto.middleware.csrf_refresh.CSRFRefresh'
]

If not using the custom middleware,I use:

'django.middleware.csrf.CsrfViewMiddleware'

instead of

'solvesto.middleware.csrf_refresh.CSRFRefresh'

The only last resort I see to make this work is to remove csrf altogether,which is of course,bad for security.

Answer 1

I removed the csrf security,no other solution,works now.