I deployed a Django 4 app with Daphne (ASGI) in a docker container. I use Caddy as a reverse proxy in front. It works, except I can't fill in any form because the CSRF protection kicks in. So no admin login, for example.
I can currently access the admin interface in two ways:
Option 1 works. I can log into the admin interface just as if I was running the development server locally. All is working as expected.
However, option 2 (caddy reverse proxy) doesn't work. I can access Django and load pages, but any form submission will be blocked because the CSRF protection kicks in.
CSRF verification failed. Request aborted.
Reason given for failure:
Origin checking failed - https://<mydomain.com> does not match any trusted origins.
My Caddyfile contains this:
<mydomain.com> {
reverse_proxy localhost:8088
}
localhost:8088 is the port exposed by my docker container.
In an effort to eliminate potential issues, I've set the following to false in my config file:
SECURE_SSL_REDIRECT
(causes a redirect loop, probably related to the reverse proxying)SESSION_COOKIE_SECURE
(I'd rather have it set to True, but I don't know at this point)CSRF_COOKIE_SECURE
(same remark)The only Django-Caddy examples I could find online are outdated and refer to older versions of Caddy and/or Django. Django is deployed on ASGI with Daphne.
I've seens posts suggesting to change CSRF_TRUSTED_ORIGINS
, but it doesn't seem right that I would have to add a host that is already in the ALLOWED_HOSTS list. That also wouldn't explain why it works directly on the docker container, unless localhost is a special case for CSRF.
Versions:
Any idea what goes wrong, and how I should go about debugging such issues?
Finally found out what was happening.
I first wanted to know the exact HTTP request that was sent from caddy to django:
sudo tcpdump -i lo -A -n port 8088
This confirmed that:
Origin
and Referer
headers were set properlycsrftoken
cookie was sent properlyOnce that was known, I could dig in the code from django. Specifically, this function in the CSRF middleware.
In conclusion:
Origin
header sent by the browser to be http://
because the request is not secure. In my case, it is https://
because my browser is talking to Caddy over httpsOrigin
header does not match what the CSRF middleware expects, the request is rejectedIt's actually a simple fix.
Since we know that Caddy will always ignore X-Forwarded-Proto
from the browser and sets it itself, we can add SECURE_PROXY_SSL_HEADER to the settings.py
in django:
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
And voilà!
Now I can also set these to true:
EDIT Here's the Caddyfile, as per requested:
service.mywebsite.com {
reverse_proxy localhost:8088
}