# How to activate CSRF token for Railway deployment

**URL:** <https://forum.djangoproject.com/t/how-to-activate-csrf-token-for-railway-deployment/22334>\
**Category:** Deployment\
**Created:** [July 16, 2023, 1:20pm UTC](https://forum.djangoproject.com/t/how-to-activate-csrf-token-for-railway-deployment/22334 "2023-07-16T13:20:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tomislavm021](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/tomislavm021/32/13462_2.png) [@tomislavm021](https://forum.djangoproject.com/u/tomislavm021)\
**Post date:** [July 16, 2023, 1:20pm UTC](https://forum.djangoproject.com/t/how-to-activate-csrf-token-for-railway-deployment/22334/1 "2023-07-16T13:20:35Z")

</div>

Hello good Django people!

I have two problems that i need help with, if you can please take a look.

I have successfully managed to (finally) upload a part of this web app i am working on, to Railway.

Problem #1  
.env file is not working on Railway, so i had to move debug and secret key setup back to settings.py. Maybe someone can give an advice on this?

Problem #2:  
CSRF token is not working when deployed to Railway. It is working totally fine in localhost, but on this live demo, it is not.

```auto
Forbidden (403)
CSRF verification failed. Request aborted.

Help
Reason given for failure:

    Origin checking failed - https://t3-production-7759.up.railway.app does not match any trusted origins.
    
In general, this can occur when there is a genuine Cross Site Request Forgery, or when Django’s CSRF mechanism has not been used correctly. For POST forms, you need to ensure:

Your browser is accepting cookies.
The view function passes a request to the template’s render method.
In the template, there is a {% csrf_token %} template tag inside each POST form that targets an internal URL.
If you are not using CsrfViewMiddleware, then you must use csrf_protect on any views that use the csrf_token template tag, as well as those that accept the POST data.
The form has a valid CSRF token. After logging in in another browser tab or hitting the back button after a login, you may need to reload the page with the form, because the token is rotated after a login.
You’re seeing the help section of this page because you have DEBUG = True in your Django settings file. Change that to False, and only the initial error message will be displayed.

You can customize this page using the CSRF_FAILURE_VIEW setting.

```

And here is my settings.py

```auto
from pathlib import Path

# Django environ
import environ

BASE_DIR = Path( __file__ ).resolve().parent.parent

env = environ.Env()
environ.Env.read_env()

SECRET_KEY='django-insecure-5vb@jpl=*u2ky$rx1sw!1safaaw+!v#aekuv7'

DEBUG=True
#SECRET_KEY = env('MY_SECRET_KEY')
#DEBUG = env.bool('DEBUG', default=False)

#ALLOWED_HOSTS = ["*"]
ALLOWED_HOSTS = ["t3-production-7759.up.railway.app"]

INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',

    # MY APPS

    'accounts',
    'dashboard',
    'blog',
    'shop',
    'courses',
    'front',

    # 3RD Party
    'crispy_forms',
    'crispy_bootstrap5',
    'captcha',
    'axes',
    'ckeditor',

    # calculate prices on cart page for product if there is more then one product
    "mathfilters",
    'django.contrib.staticfiles',
    'whitenoise.runserver_nostatic',    
]

CRISPY_TEMPLATE_PACK = 'bootstrap5'

MIDDLEWARE = [
    
    # whitenoise
    "whitenoise.middleware.WhiteNoiseMiddleware",
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',

    # axes
    'axes.middleware.AxesMiddleware',

]

AUTHENTICATION_BACKENDS = [
    # AxesStandaloneBackend should be the first backend in the AUTHENTICATION_BACKENDS list.
    'axes.backends.AxesStandaloneBackend',

    # Django ModelBackend is the default authentication backend.
    'django.contrib.auth.backends.ModelBackend',
]

ROOT_URLCONF = 'project.urls'

TEMPLATES = [
    {
        'BACKEND': 'django.template.backends.django.DjangoTemplates',
        'DIRS': [],
        'APP_DIRS': True,
        'OPTIONS': {
            'context_processors': [
                'django.template.context_processors.debug',
                'django.template.context_processors.request',
                'django.contrib.auth.context_processors.auth',
                'django.contrib.messages.context_processors.messages',
                # by me:
                'shop.context_processors.cart',
                'shop.context_processors.category_links',
                'shop.context_processors.courses',
            ],
        },
    },
]

WSGI_APPLICATION = 'project.wsgi.application'

'''DATABASES={
   'default':{
      'ENGINE':'django.db.backends.postgresql_psycopg2',
      'NAME':'tm3',
      'USER':'postgres',
      'PASSWORD':'10203344',
      'HOST':'localhost',
      'PORT':'5432',
   }
}'''

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.sqlite3',
        'NAME': BASE_DIR / 'db.sqlite3',
    }
}

AUTH_PASSWORD_VALIDATORS = [
    {
        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
    },
]

LANGUAGE_CODE = 'en-us'
TIME_ZONE = 'UTC'
USE_I18N = True
USE_TZ = True

STATIC_URL = 'static/'
STATICFILES_DIRS = [
    BASE_DIR / 'static/'
]
STATIC_ROOT = 'static_root'
STATICFILES_STORAGE = "whitenoise.storage.CompressedManifestStaticFilesStorage"

MEDIA_URL = '/media/'
# media dir
MEDIA_ROOT = BASE_DIR / 'media'

DEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField'

# DEFINE OUR CUSTOM USER MODEL
AUTH_USER_MODEL = 'accounts.USER'

# EMAIL SMTP CONFIGURATION
EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
DEFAULT_FROM_EMAIL = 'info@tmdemo.xyz'
EMAIL_HOST = 's618.fra8.mysecurecloudhost.com'
EMAIL_PORT = '465'
EMAIL_USE_SSL = True
EMAIL_HOST_USER = 'info@tmdemo.xyz'
EMAIL_HOST_PASSWORD = ';Jh)sasfwqSK'

RECAPTCHA_PUBLIC_KEY = '6LfK9CInAAAAAEWn4M-a5A_H52fd_0MIG8hTfD6M'
RECAPTCHA_PRIVATE_KEY = '6LfK9CInAAAAAAJs0_CEtxVw2uaXnUqjNxWl4xVM'

# AXES 
AXES_FAILURE_LIMIT = 3 # koliko puta moze da promasi login
AXES_COOLOFF_TIME = 1 # cekaj 1 sat pre nego sto mozes opet da pokusas da se ulogujes
AXES_RESET_ON_SUCCESS = True # Reset failed login attempts upon successfull login
AXES_LOCKOUT_TEMPLATE = 'accounts/account-locked.html'
AXES_LOCKOUT_PARAMETERS = ['ip_address']

CKEDITOR_UPLOAD_PATH = 'uploads/'

CKEDITOR_CONFIGS = {
    'default': {
        'toolbar': 'Custom',
        'toolbar_Custom': [
            ['Bold', 'Italic', 'Underline'],
            ['NumberedList', 'BulletedList'],
            ['Link', 'Unlink'],
            ['RemoveFormat'],
            ['Image'],
        ],
        'filebrowserUploadUrl': '/upload/', # Postavite URL za upload slika
        'filebrowserUploadMethod': 'form', # Postavite način slanja forme za upload
    },
}

CART_SESSION_ID = 'cart'

CSRF_TRUSTED_ORIGINS = ['t3-production-7759.up.railway.app']
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True

```

I changed the secret key a bit, just wanted to show so you can see and maybe help 🙂

Thank you!

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [July 16, 2023, 1:37pm UTC](https://forum.djangoproject.com/t/how-to-activate-csrf-token-for-railway-deployment/22334/2 "2023-07-16T13:37:52Z")

</div>

Regarding the [`CSRF_TRUSTED_ORIGINS`](https://docs.djangoproject.com/en/4.2/ref/settings/#csrf-trusted-origins) question, the specification must include the `http://` (and/or `https://` ) scheme with the domain name. (Also see [Django 4.0 release notes | Django documentation | Django](https://docs.djangoproject.com/en/4.2/releases/4.0/#csrf-trusted-origins-changes))

---

<div class="post-metadata">

**Author:** ![tomislavm021](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/tomislavm021/32/13462_2.png) [@tomislavm021](https://forum.djangoproject.com/u/tomislavm021)\
**Post date:** [July 16, 2023, 2:48pm UTC](https://forum.djangoproject.com/t/how-to-activate-csrf-token-for-railway-deployment/22334/3 "2023-07-16T14:48:05Z")

</div>

Thank you very much, it is working now!