Search code examples
djangohttpscsrfdjango-csrf

Django CSRF for both HTTP and HTTPS

I have a blog that runs behind both HTTP and HTTPS and am running into issues with the csrf token verification.

The CSRF token is available in each form as it should be, but when I'm on the HTTP version of the site and try to commit a comment I get the following error.

Forbidden (403) CSRF verification failed. Request aborted.

Referer checking failed - http://mysite.com/blog/1/ does not match https://mysite.com/.

It works fine when viewing the blog via HTTPS.

Anyone know how to get the verification to match both?

Solution

  • I figured it out. It was an issue with my fastcgi parameters

    fastcgi_param HTTPS on;

    setting an environ variable that required HTTPS to be on. Django does some extra enforcement for the csrf tokens when this variable is on.