CSRF verification failed. Request aborted while trying to log in safari only

828 views
Skip to first unread message

i bigoss

unread,
Jun 17, 2014, 2:14:03 PM6/17/14
to mezzani...@googlegroups.com
Hi ,

I've set up a basic site on remote server with Mezzanine. It works like a charm and is almost out of the box if I compare it to django cms
I have not used fabric as due to  poor documentation it was to hard for me to make it work.
However now the site is on the server. I am using nginx and gunicorn / supervisor. There are other sites on my server. Each site uses different port to proxy between nginx and gunicorn. Everything works well beside the fact that I can't log in or register new account using safari 7.0.4
Other browsers works,  tested with chrome, opera and ff not sure about ie..
Each time I am trying to log in on safari I get 403 forbidden CSRF verification failed. Request aborted.
with Debug true I se some more info: 

Reason given for failure:

    CSRF cookie not set.....

Does anyone know what can possibly cause it ?


Regards

Jaroslaw
    


i bigoss

unread,
Jun 18, 2014, 4:46:27 AM6/18/14
to mezzani...@googlegroups.com
Just found out that above problem regards all forms on the site so I can't send email etc 
Safari only .

Any ideas how to fix it?

Regards

Jaroslaw

Pahaz Blinov

unread,
Jun 19, 2014, 5:22:55 AM6/19/14
to mezzani...@googlegroups.com
Please, watch in you browser dev tools: sending or no input param `csrftoken`?

i bigoss

unread,
Jun 20, 2014, 7:54:01 AM6/20/14
to mezzani...@googlegroups.com
Thank you Pahaz,

I can send forms with following  setting: 
 block cookies and other website data - set to never
 however default setting for my safari seems to be:  from thirds parties and advertisers.
looking at the cookies from my website 
some of them have domain : mysitesdomain.com
 and some including csrftoken have my sites ip address instead.
I think does with ip are treated as 3rd party. 
How can i change ip to domain name ? does it have anything to do with my nginx settings?

Kind regards

Jaroslaw

i bigoss

unread,
Jun 20, 2014, 9:07:01 AM6/20/14
to mezzani...@googlegroups.com
I have tried following in my settings.py 
DOMAIN_NAME = "mydomainname.com"

CSRF_COOKIE_DOMAIN = DOMAIN_NAME

But still my csrf  _utma _utmz cookies are set to ip address as domain
Reply all
Reply to author
Forward
0 new messages