I recently incorporated django-axes into a Django project that uses django-allauth for logins. On the development machine, it all seems to work (strangely) but it fails in production environment.
Here is what I get:
File "/srv/project/venv/lib64/python3.14/site-packages/allauth/core/internal/ratelimit.py", line 113, in get_ip
ip = get_adapter().get_client_ip(request)
File "/srv/project/venv/lib64/python3.14/site-packages/allauth/account/adapter.py", line 848, in get_client_ip
raise PermissionDenied("Unable to determine client IP address")
django.core.exceptions.PermissionDenied: Unable to determine client IP address
Investigating the above traceback led me to this release notice. This is all mysterious to me at the moment. Has anyone been through this path before? I would appreciate some guidance.
Below are the relevant entries in project.settings:
MIDDLEWARE = [
"django.middleware.security.SecurityMiddleware",
"django.contrib.sessions.middleware.SessionMiddleware",
....,
....,
"django.middleware.clickjacking.XFrameOptionsMiddleware",
....,
"axes.middleware.AxesMiddleware",
"django_browser_reload.middleware.BrowserReloadMiddleware",
]
AXES_USERNAME_FORM_FIELD = "login"
AXES_FAILURE_LIMIT = 2
AXES_COOLOFF_TIME = None
AUTHENTICATION_BACKENDS = (
# Prevent login bots and brute-force attacks
"axes.backends.AxesBackend",
# Needed to login by username in Django admin, regardless of `allauth`
"django.contrib.auth.backends.ModelBackend",
# `allauth` specific authentication methods, such as login by e-mail
"allauth.account.auth_backends.AuthenticationBackend",
)
# Secure HTTP headers
SECURE_CONTENT_TYPE_NOSNIFF = True
SECURE_SSL_REDIRECT = True
SECURE_HSTS_SECONDS = True
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True
X_FRAME_OPTIONS = 'DENY'
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True