# CSRF failure on login in production

**URL:** <https://forum.djangoproject.com/t/csrf-failure-on-login-in-production/20494>\
**Category:** Deployment\
**Created:** [April 24, 2023, 5:21pm UTC](https://forum.djangoproject.com/t/csrf-failure-on-login-in-production/20494 "2023-04-24T17:21:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![RichardWoj](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/richardwoj/32/12824_2.png) [@RichardWoj](https://forum.djangoproject.com/u/RichardWoj)\
**Post date:** [April 24, 2023, 5:21pm UTC](https://forum.djangoproject.com/t/csrf-failure-on-login-in-production/20494/1 "2023-04-24T17:21:38Z")

</div>

I 'm in the process of trying to put in place a deployment process on Azure. I have an almost empty app (no form, just display a home page).  
In development environment (running on the local Django server with Debug = True), everything is ok.  
But on the production server (onAzure), with DEBUG = FALSE, hhen I want to login and submit id & password I get the following message: Forbidden (403) CSRF verification failed. Request aborted.More information is available with DEBUG=True.

Has anyone a clue of what could go wrong?

Thanks

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [April 24, 2023, 6:54pm UTC](https://forum.djangoproject.com/t/csrf-failure-on-login-in-production/20494/2 "2023-04-24T18:54:42Z")

</div>

See [How to use Django’s CSRF protection | Django documentation | Django](https://docs.djangoproject.com/en/4.2/howto/csrf/) for details. If you think you’ve already done everything appropriately, please post the template you are using for your login page.

---

<div class="post-metadata">

**Author:** ![RichardWoj](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/richardwoj/32/12824_2.png) [@RichardWoj](https://forum.djangoproject.com/u/RichardWoj)\
**Post date:** [April 25, 2023, 9:47am UTC](https://forum.djangoproject.com/t/csrf-failure-on-login-in-production/20494/3 "2023-04-25T09:47:10Z")

</div>

Adding CSRF\_TRUSTED\_ORIGINS=[‘[https://mysite](https://mysite)’] in setting.py solved the issuer!