# Cannot access admin if setting is set. Cannot access website if setting is not set

**URL:** <https://forum.djangoproject.com/t/cannot-access-admin-if-setting-is-set-cannot-access-website-if-setting-is-not-set/24496>\
**Category:** Deployment\
**Created:** [October 13, 2023, 7:22am UTC](https://forum.djangoproject.com/t/cannot-access-admin-if-setting-is-set-cannot-access-website-if-setting-is-not-set/24496 "2023-10-13T07:22:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![calcanisa](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/calcanisa/32/10066_2.png) [@calcanisa](https://forum.djangoproject.com/u/calcanisa)\
**Post date:** [October 13, 2023, 7:22am UTC](https://forum.djangoproject.com/t/cannot-access-admin-if-setting-is-set-cannot-access-website-if-setting-is-not-set/24496/1 "2023-10-13T07:22:07Z")

</div>

I have a Django website in production so DEBUG = False

There is a setting:  
SESSION\_COOKIE\_SECURE = True

If it is set to True then I can access the admin and log in, but then I cannot access the website itself and I get a bad gateway error. If the setting is missing or set to False then I can access the website fine but I cannot log into admin. A bit confusing

Here are the settings related to domains and CSRF:

```auto
ALLOWED_HOSTS = ["localhost","102.219.85.91","founderslooking.com","app.founderslooking.com"]

CORS_ALLOWED_ORIGINS = [
    "http://localhost",
    "http://127.0.0.1",
    "http://localhost:file",
    "http://app.founderslooking.com",
]

CORS_ORIGIN_ALLOW_ALL = True

CORS_ALLOW_CREDENTIALS = True

SESSION_COOKIE_SAMESITE = None

SESSION_COOKIE_DOMAIN = "founderslooking.com"

SESSION_COOKIE_SECURE = True

CSRF_TRUSTED_ORIGINS = ["http://localhost", "http://*.127.0.0.1", "http://app.founderslooking.com",]

INTERNAL_IPS = [
    "127.0.0.1",
]

```

First time I deploy a Django site so not sure what the settings should be for production. Thanks

I see this error in the NginX log:

```auto
*611 upstream prematurely closed connection while reading response header from upstream,

```

---

<div class="post-metadata">

**Author:** ![addwebsolution](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/addwebsolution/32/23762_2.png) [@addwebsolution](https://forum.djangoproject.com/u/addwebsolution)\
**Post date:** [October 13, 2023, 9:58am UTC](https://forum.djangoproject.com/t/cannot-access-admin-if-setting-is-set-cannot-access-website-if-setting-is-not-set/24496/2 "2023-10-13T09:58:09Z")

</div>

Did you used SSL for your site like are you surfing your site on http or https?  
Because if you have added these 3 in your settings then you should use https to serve your site.

```auto
SECURE_SSL_REDIRECT = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True

```