last day (16 days later) » 

16:22
0
Q: Django HTTPS with nginx as reverse proxy. Issues with CSRF tokens

GNAI developed a Django application which runs inside a docker container. Outside the container, a natively running nginx does the reverse proxy-ing of the requests to that django application. Django runs via WSGI with gunicorn. General setup: I use a HTTP sever on port 80 which only serves a redir...

Please don't ask multiple questions in one post, if you want to ask about an issue with CSRF tokens ask only about that.
GNA
GNA
Unfortunately, the linked issue does not explain to me why one setup fails just because of different nginx versions. More precisely, I understand, why it fails but don't get, why it can actually work on another setup.
Did you actually confirm that the issue is due to NGINX version by either you downgrading your environments version or them upgrading theirs? The most likely explanation for what happened is in the answer to the linked question.
GNA
GNA
@AbdulAzizBarkat I honestly don't get it, sorry. I have a working setup with nginx -> docker -> gunicorn -> django. According to the linked question, the allowed IP for redirection of the proto header is 127.0.0.1 by default, which would break in the docker container as the bridge has a completely different IP and would either require the setup to configure gunicorn correctly or allow django with the setting to use the HTTP header for its is_secure() determination. But why does it work without any of these settings on one machine?
My problem is not, that it doesn't work on one machine. I totally get why. I can't understand why it works on my server without any proper configuration. If i remove proxy_set_header X-Forwarded-Proto $scheme; from the nginx config, it still works.
In that case your question lacks some debugging information. What's the versions of Django, gunicorn, docker that you're using? How do you and your friend run the container? What's your friends nginx config? Are you using Dockers host network mode?
GNA
GNA
16:22
@AbdulAzizBarkat I added my request.META output to my original question. Django 5.1.3 I have not set SECURE_PROXY_SSL_HEADER and the wsgi.url_scheme shows http. Despite that everything is working.
@GNA are you potentially making CORS requests to your app? What is the exact error your friend gets. Please add the complete error traceback.
What's your setting for CSRF_TRUSTED_ORIGINS?
GNA
GNA
16:50
I havent explicitly set CSRF_TRUSTED_ORIGINS
I'm trying to get the error trace. But that might take some time
@GNA My guess it that the error is the one here
If you see this answer it pretty much explains what happens. You end up comparing something like https://www.example.com (Origin header) to http://www.example.com (What Django assumes Origin header should be)
GNA
GNA
I don't do CORS
POST, etc. requests have an Origin header
Even though they are same origin
GNA
GNA
But I will report back once ive seen the error myself
I apriciate your help. Is it okay if I report back tomorrow? I'm out and was doing all the debugging over ssh on my cell phone. Tomorrow I will have more info
17:11
@GNA that's fine, just make sure to @ ping me if you reply, I don't get notified otherwise.
GNA
GNA
17:29
@AbdulAzizBarkat forbidden 403. <Domain> does not match any trusted domains
So it is what you suspect
Origin checkin failed
If that's the case you probably have CSRF_TRUSTED_ORIGINS configured somewhere while your friend doesn't or are you actually hitting it with HTTP and not HTTPS?
GNA
GNA
"CSRF verification failed. Request aborted.

Help
Reason given for failure:

Origin checking failed - censored.net does not match any trusted origins.

In general, this can occur when there is a genuine"
https://test/login/#:~:text=CSRF%20verification%20failed,is%20a%20genuine
We have the literally same docker image
And why does it get solved by setting the proxy protocol
@GNA Because then is_secure returns True and Django checks it against https.
GNA
GNA
What does it check against https?
We have identical nginx configs and containers
@GNA Hmm, still multiple ways that can go wrong. Lets say you both have CSRF_TRUSTED_ORIGINS set but its value is set to the domain name you're using and not the one your friend uses. Other ways could be that some of the settings might depend on environment variables, mounted files, etc.
GNA
GNA
17:35
Only the domain names differ
@GNA Your request has an Origin header, Django compares that against http://HOST while the origin headers value is https://HOST
This answer explains it as I mentioned.
GNA
GNA
I havent configured that either. And it just works.
I access my installation pver https as well and it gets lost in the proxy. But still everything works
After the check the linked answer mentions Django also goes over the origins in CSRF_TRUSTED_ORIGINS to see if any match, if they do _origin_verified returns True. So very likely somewhere you aren't looking the setting is configured.
GNA
GNA
So i guess his installation behaves correctly. And mine is broken. I will check that.
I will debug that and write you
 
5 hours later…
GNA
GNA
23:08
@AbdulAzizBarkat
I have the following:
HTTP_ORIGIN https://my.domain.com
HTTP_REFERER https://my.domain.com/some/site
wsgi.url_scheme http
and request.is_secure() -> False
I used grep on the whole codebase. -> No reference to my domain expect for the ALLOWED_HOSTS entry
I created a new subdomain and set it as ALLOWED_HOST
Still everything works perfectly on my end
I can't understand why it works and is unbreakble on my side, but does not work on my friend's setup
GNA
GNA
23:34
I found some clue:
venv/lib/python3.12/site-packages/django/middleware/csrf.py looks differnetly on my development machine and the container
despite the same django verison being installed
GNA
GNA
23:45
Okay. I found out the problem! Thanks @AbdulAzizBarkat for the link above. For some reason the virtual env inside the container survived the update form django 3 to 5.
The code didn't seem to exist in that version yet.
I completely cleared all my containers and pruned all images
Works now

  last day (16 days later) »