After login I got: CSRF verification failed. Request aborted. about trax

[zarej]

Thank you very much. It is working now.

[agateblue]

Hi and sorry for the delay!

Can you tell me how your instance is deployed? I'm especially interested in your webserver setup. Do you have a reverse proxy in front of the app and, if yes, how is it configured ?

[zarej]

Hi and thanks for the response.
I tried on 2 different servers and got the same results. Things that I do are following this tutorial step by step https://traxio.readthedocs.io/en/latest/deploy.html

# clone the repository
git clone https://github.com/EliotBerriot/trax.git
cd trax

# setup the environment variables
# edit the .env file, especially the TIME_ZONE variable
# and the DJANGO_ALLOWED_HOSTS one
cp env.example .env
nano .env

# set up the docker-compose file
# customize any configuration in the docker compose file
# especially, you can change the listening port and ip
cp docker-compose.example.yml docker-compose.yml
nano docker-compose.yml

# build and run the containers
docker-compose build
docker-compose up -d

# create tables in the database
docker-compose run django python manage.py migrate

# create an admin user (this will be needed to configure your tokens)
docker-compose run django python manage.py createsuperuser

Changed just DJANGO_ALLOWED_HOSTS=dev.minimaldevelo.com in .env

I got http://dev.minimaldevelop.com:8079/accounts/login/ when I try to login I got CSRF error.

I don't have reverse proxy set.

Here are docker ps

CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                  NAMES
03925d23cebe        trax_nginx          "nginx -g 'daemon of…"   2 days ago          Up 2 days           0.0.0.0:8079->80/tcp   trax_nginx_1
0fc23cf0c9f4        trax_django         "/entrypoint.sh /gun…"   2 days ago          Up 2 days                                  trax_django_1
a4f193fe6710        trax_worker         "/entrypoint.sh pyth…"   2 days ago          Up 2 days                                  trax_worker_1
1bb42258165a        trax_postgres       "docker-entrypoint.s…"   2 days ago          Up 2 days           5432/tcp               trax_postgres_1
90ebdace0cce        redis:latest        "docker-entrypoint.s…"   2 days ago          Up 2 days           6379/tcp               trax_redis_1

If you need some more information please let me know. I am willing to give you access to server if you like.

[agateblue]

Thanks for the additional info. I think you're bitten by this setting. Basically, trax is designed to be deployed in a secure-first way, meaning it will only send cookies and CSRF toen when served behind an https connection.

Can you please try adding a reverse proxy in front of trax. On nginx, the configuration should look like this:

upstream trax {
    # depending on your setup, you may want to udpate this
    server localhost:8079;
}

# Uncomment this after you have https setup
# server {
#   listen 80;
#   listen [::]:80;
#   server_name trax.yourdomain.com;
#   location / { return 301 https://$host$request_uri; }
# }

server {
    listen      443 ssl;
    listen [::]:443 ssl;
    server_name trax.yourdomain.com;

    ssl_certificate      /etc/ssl/yourcert/domain.crt;
    ssl_certificate_key  /etc/ssl/yourcert/domain.key;

    location /
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        # this is the important bit: if you cannot serve trax behind https for
        # some reason, you can comment this line and uncomment the next one.
        # It will lie to trax about being served behind https
        proxy_set_header X-Forwarded-Proto $scheme;
        # proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Host   $host:$server_port;
        proxy_set_header X-Forwarded-Port   $server_port;

        proxy_redirect off;
        proxy_pass   http://trax;
    }
}

If it works, it's definitely an https issue, and I'll make a PR so we can configure trax to work on http as well. I realize we also miss some documentation about the reverse proxy part.

[zarej]

I have created proxy with nginx which is on the host server error regarding CSRF is gone, but I have only this page:
http://storage3.static.itmages.com/i/18/0226/h_1519679306_9829953_05af346043.png
I cannot setup token because when I point to https://dev.minimaldevelop.com/trax/admin it says Page not found, is it some problem with the proxy settings?

[agateblue]

It's probably because you miss the DJANGO_ADMIN_URL setting in your .env file. You can set it to ^trax/admin/ if you want the admin to be reachable at https://dev.minimaldevelop.com/trax/admin

I'm really sorry for the trouble, it's an old project and I don't have much time to maintain it these days :/