# Django Admin form redirecting with 403 Error for Abstract Class.?

**URL:** <https://forum.djangoproject.com/t/django-admin-form-redirecting-with-403-error-for-abstract-class/24215>\
**Category:** Deployment\
**Created:** [September 29, 2023, 10:12am UTC](https://forum.djangoproject.com/t/django-admin-form-redirecting-with-403-error-for-abstract-class/24215 "2023-09-29T10:12:22Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![HarshaReddyV](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/harshareddyv/32/16077_2.png) [@HarshaReddyV](https://forum.djangoproject.com/u/HarshaReddyV)\
**Post date:** [September 29, 2023, 10:12am UTC](https://forum.djangoproject.com/t/django-admin-form-redirecting-with-403-error-for-abstract-class/24215/1 "2023-09-29T10:12:22Z")

</div>

I am using Django 4.2.4 and started using AbstractUser model for login.  
It works fine on locally but when deployed to Azure it throws 403 error with CSRF validation error after redirecting to the same url.  
 ![image](https://us1.discourse-cdn.com/flex026/uploads/djangoproject/original/3X/6/0/6004c762f3444d23d462f6039aa1fef058d4dff4.png)

```auto
SECRET_KEY = 'django-insecure-ctozxf(#6@or3k6n35_(15#wq#q_wzv^b88djebqwgl2+0uq^$o'
DEBUG = True
ALLOWED_HOSTS = ['*']
CSRF_TRUSTED_ORIGINS = ['rallys.azurewebsites.net','https://*.127.0.0.1']
AUTH_USER_MODEL = 'home.User'

```

I have tried

```auto
CSRF_TRUSTED_ORIGINS = ['https://rallys.azurewebsites.net/']
CSRF_TRUSTED_ORIGINS = ['https://*.rallys.azurewebsites.net/']

```

I am using sqlite3 for db.

---

<div class="post-metadata">

**Author:** ![addwebsolution](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/addwebsolution/32/23762_2.png) [@addwebsolution](https://forum.djangoproject.com/u/addwebsolution)\
**Post date:** [September 29, 2023, 10:32am UTC](https://forum.djangoproject.com/t/django-admin-form-redirecting-with-403-error-for-abstract-class/24215/2 "2023-09-29T10:32:27Z")

</div>

There was similar issue just like this here you can go to topic [CSRF verification failed. Request aborted for /admin/](https://forum.djangoproject.com/t/csrf-verification-failed-request-aborted-for-admin/24154)

---

<div class="post-metadata">

**Author:** ![HarshaReddyV](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/harshareddyv/32/16077_2.png) [@HarshaReddyV](https://forum.djangoproject.com/u/HarshaReddyV)\
**Post date:** [September 29, 2023, 11:21am UTC](https://forum.djangoproject.com/t/django-admin-form-redirecting-with-403-error-for-abstract-class/24215/3 "2023-09-29T11:21:41Z")

</div>

Sorry, I have looked at the topic before but am not using the API.

Could you let me know how I can simply implement it for a basic Django project.  
What is cause for the issue and work around.?

Where can I include csrf for the Abstract user model.

---

<div class="post-metadata">

**Author:** ![addwebsolution](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/addwebsolution/32/23762_2.png) [@addwebsolution](https://forum.djangoproject.com/u/addwebsolution)\
**Post date:** [September 29, 2023, 11:28am UTC](https://forum.djangoproject.com/t/django-admin-form-redirecting-with-403-error-for-abstract-class/24215/4 "2023-09-29T11:28:24Z")

</div>

In the above topic there was issue with csrftoken set to browser in the cookies. It has same issue read the discussions properly you will get it.

---

<div class="post-metadata">

**Author:** ![HarshaReddyV](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/harshareddyv/32/16077_2.png) [@HarshaReddyV](https://forum.djangoproject.com/u/HarshaReddyV)\
**Post date:** [September 29, 2023, 11:36am UTC](https://forum.djangoproject.com/t/django-admin-form-redirecting-with-403-error-for-abstract-class/24215/5 "2023-09-29T11:36:58Z")

</div>

Looked at the Cookie it was csrftoken for me.  
It’s the same even after clearing it and refresh.

---

<div class="post-metadata">

**Author:** ![addwebsolution](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/addwebsolution/32/23762_2.png) [@addwebsolution](https://forum.djangoproject.com/u/addwebsolution)\
**Post date:** [September 29, 2023, 11:38am UTC](https://forum.djangoproject.com/t/django-admin-form-redirecting-with-403-error-for-abstract-class/24215/6 "2023-09-29T11:38:23Z")

</div>

On this `https://rallys.azurewebsites.net` or on `localhost`? have you checked on both.

---

<div class="post-metadata">

**Author:** ![HarshaReddyV](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/harshareddyv/32/16077_2.png) [@HarshaReddyV](https://forum.djangoproject.com/u/HarshaReddyV)\
**Post date:** [September 29, 2023, 11:41am UTC](https://forum.djangoproject.com/t/django-admin-form-redirecting-with-403-error-for-abstract-class/24215/7 "2023-09-29T11:41:37Z")

</div>

Works fine on local host.  
But doesn’t work on Azure Webapp.

Also the passwords created inside the Admin panel on local machine are not encrypting, they are showing in plain text unlike other project, if that might be related ?

---

<div class="post-metadata">

**Author:** ![addwebsolution](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/addwebsolution/32/23762_2.png) [@addwebsolution](https://forum.djangoproject.com/u/addwebsolution)\
**Post date:** [September 29, 2023, 11:43am UTC](https://forum.djangoproject.com/t/django-admin-form-redirecting-with-403-error-for-abstract-class/24215/8 "2023-09-29T11:43:46Z")

</div>

You are using AbstractUser right? can you share models, managers if any, and how you are creating users.

---

<div class="post-metadata">

**Author:** ![HarshaReddyV](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/harshareddyv/32/16077_2.png) [@HarshaReddyV](https://forum.djangoproject.com/u/HarshaReddyV)\
**Post date:** [September 29, 2023, 12:41pm UTC](https://forum.djangoproject.com/t/django-admin-form-redirecting-with-403-error-for-abstract-class/24215/10 "2023-09-29T12:41:43Z")

</div>

```auto
from django.db import models
from django.contrib.auth.models import AbstractUser
from django.core.exceptions import ValidationError

class User(AbstractUser):
    pass

class Tickers(models.Model):
    id = models.AutoField(primary_key=True)
    title = models.CharField(max_length=100, blank=False)
    description = models.TextField(max_length=500, blank=False, default='This is a Product..!')
    bse_code = models.CharField(max_length=20)
    nse_code = models.CharField(max_length=20)

    def __str__ (self):
        return (self.title)

```

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [September 30, 2023, 12:17am UTC](https://forum.djangoproject.com/t/django-admin-form-redirecting-with-403-error-for-abstract-class/24215/11 "2023-09-30T00:17:33Z")

</div>

You’ve got an extra trailing ‘/’ on the end of your entries in `CSRF_TRUSTED_ORIGINS`.

---

<div class="post-metadata">

**Author:** ![HarshaReddyV](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/harshareddyv/32/16077_2.png) [@HarshaReddyV](https://forum.djangoproject.com/u/HarshaReddyV)\
**Post date:** [September 30, 2023, 8:58am UTC](https://forum.djangoproject.com/t/django-admin-form-redirecting-with-403-error-for-abstract-class/24215/12 "2023-09-30T08:58:44Z")

</div>

My Project is working fine in localhost but have trouble in production when the admin redirects to a different url. I guess the https is converting into http which i haven’t provided in the trusted origins for csrf. I have included the below code in settings and it works fine in Azure webapp

SECURE\_PROXY\_SSL\_HEADER = (‘HTTP\_X\_FORWARDED\_PROTO’, ‘https’)

In settings.py