[Django]-Django admin login returns Forbidden 403 CSRF verification failed. Request aborted

6👍

add this to your settings.py and it will work
CSRF_TRUSTED_ORIGINS = [‘https://example.com’]

5👍

You are setting SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
Remove this line and see if that solves your issue. If you are enabling https csrf will work only as per the specifications of https. There is a possibility that you are enabling https and serving your website from a non-https server. Also, Have you tried in another browser after clearing cookies or in private/incognito mode? Sometimes this error occurs because csrf cookie is not set correctly. Try inspecting your request/response headers from browser console.

2👍

Spend some hours debugging this problem. None of the above fixed it.

What finally worked for me is disabling browser extensions. Some custom packages on my dev machine seemed to remove the CSRF token somehow.

1👍

remove browser cookies and refresh the admin page

0👍

I have no clue why this is the answer, but I went in and updated my Django to the current release. For whatever reason this solved the problem…

pip install --upgrade django==1.10.2

0👍

The same problem had occurred with me too.

Actually the problem was that the my Django app was not using the dependencies from virtual environment even it was activated.

I had installed Django 1.8 in my system and Django 1.11.2 in virtual environment.

So the problem was with the Django version.

Finally I fixed issues as follows,

1) Deleted/Renamed virtualenv and created new one

rm -rf venv && virtualenv venv

2) Activated virtualenv

on MAC

source ./venv/bin/activate

on Windows

.\venv\Scripts\activate

3) Installed dependencies from pip-requirements.txt file(If you have otherwise you will need to install dependencies separately)

pip install -r pip-requirements.txt

4) After that I started start development server(python manage.py runserver) and try to login. It will work.

Check pip freeze does not show all installed packages also.

👤hygull

0👍

As suggested in one of the answers, could be browser plugins removing cookies / CSRF..
I opened the same page in safari and it worked.

Leave a comment