django CSRF issue

[yongra]

I need to run MyLA using a FQDN. When I try it, I get the error below. Is there a way to make this demo site run with an IP address or FQDN? It is hard to show people to look at the demo site using localhost:5001.

Thank you,

Ra

Forbidden (403)
CSRF verification failed. Request aborted.
You are seeing this message because this site requires a CSRF cookie when submitting forms. This cookie is required for security reasons, to ensure that your browser is not being hijacked by third parties.
If you have configured your browser to disable cookies, please re-enable them, at least for this site, or for “same-origin” requests.

[jonespm]

You'd either have to use something like ngrok which we have documented in the LTI page if you wanted to launch if from Canvas. The free version requires you to reconfigure it since there isn't a static URL but it's an inexpensive option for testing.

Or you could just use local logins and not launch from Canvas which should still be enabled and available in the default configuration.

[yongra]

We are not looking to connect this with our Canvas yet. We want to look at it first. So, the only way to see them is by using the localhost URL on the console? There is no way to use FQDN or an IP, right?

Thank you.

[jonespm]

I'm not really sure what you mean. If you have a Static IP, you can use that as a domain and open it up to anyone you'd want to. I'm not sure what page you'd be getting a CSRF from.

Unless your setting "CSRF_COOKIE_SECURE": true. That has to be set if you're running over HTTPS proxy (like ngrok or nginx or something)

Maybe you could try to add localhost or 127.0.0.1 or whatever domain to CSRF_TRUSTED_ORIGINS but that shouldn't be causing an issue.

You might be able to remove the django.middleware.csrf.CsrfViewMiddleware

from settings.py MIDDLEWARE and disable CSRF entirely for development if that's what's causing a problem.

[yongra]

I am sorry. I am not familiar with Python and Docker. I changed the csrf_cookies_secrure to true and added our domain name to the trusted origin, but no luck. There were no settings for django.middleware.csrf setting anywhere on the env.json, unless I am looking at the wrong time. How can I modify settings.py in the docker container?