We Keep Coding

Django CSRF Malfunction after using HTTPS

I know that this problem is occurs many times here. But none of them has working for me right now. I've been struggling in this error since I change the protocol of my app to https using apache2 and LetsEncrypt. I try the configurations in settings but it doesn't solve the problem.
# settings.py
CSRF_COOKIE_DOMAIN = ".myapp.ml"
CSRF_COOKIE_SECURE = True
CSRF_USE_SESSIONS = True
SESSION_COOKIE_SECURE = True
Ofcourse in every forms with POST method required that I have has {% csrf_token %} in there. It also shows in request data. This errors occurs in Log in and Sign Up forms.
Inside the app after I add csrf_exempt in login and signup, I use DRF and when I make requests like POST, DELETE, PUT etc... It only shows the error {"detail":"CSRF Failed: Referer checking failed - no Referer."}
Here is my apache2 configuration file:
<IfModule mod_ssl.c>
<VirtualHost *:443>
# The ServerName directive sets the request scheme, hostname and port that
# the server uses to identify itself. This is used when creating
# redirection URLs. In the context of virtual hosts, the ServerName
# specifies what hostname must appear in the request's Host: header to
# match this virtual host. For the default virtual host (this file) this
# value is not decisive as it is used as a last resort host regardless.
# However, you must set it for any further virtual host explicitly.
ServerName www.myapp.ml
ServerAdmin webmaster#localhost
DocumentRoot /var/www/html
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
#LogLevel info ssl:warn
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
Alias /app /home/app/app-src/static_root
<Directory /home/app/app-src/static_root>
Require all granted
</Directory>
Alias /media /home/app/app-src/media
<Directory /home/app/app-src/media>
Require all granted
</Directory>
<Directory /home/app/app-src/Project>
<Files wsgi.py>
Require all granted
</Files>
</Directory>
WSGIScriptAlias / /home/app/app-src/Project/wsgi.py
WSGIDaemonProcess Project python-path=/home/app/app-src python-home=/home/app/app-src/venv
WSGIProcessGroup Project
# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
# after it has been globally disabled with "a2disconf".
#Include conf-available/serve-cgi-bin.conf
WSGIPassAuthorization On
SSLCertificateFile /etc/letsencrypt/live/www.myapp.ml/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/www.myapp.ml/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>
NOTE: That is only occuring when I use the HTTPS protocol.

UPDATE
I start to find the bug here and I found it on my OWN HTML FILE! I Literally forgot that one of my meta tags set the referrer to no-referrer so I just replace it with origin then everything works fine.

How can I generate URLs for uploaded files on my machine? (deployed Flask on Apache2 Debian)

In a Flask python function, I want to take a saved file and figure out the URL for it so I can input it into the Google Docs Viewer. So if I save 'test.pdf', it might return 'mydomain.com/www/html/myapp/packets/test.pdf'.
However I cannot figure out how to do this. It worked fine when I was in development, but broke since I deployed it. This is my apache2 config file.
<VirtualHost *:80>
DocumentRoot /var/www/html/myapp
ServerName mydomain.com
WSGIScriptAlias / /var/www/html/myapp/myapp.wsgi
<Directory /var/www>
Order deny,allow
Allow from all
</Directory>
ErrorLog /var/www/html/error.log
LogLevel info
CustomLog /var/www/html/access.log combined
</VirtualHost>
And my Python function (using AJAX to do the file upload):
#app.route('/uploadajax', methods=['POST', 'GET'])
def upload():
file = request.files['file']
if file and allowed_file(file.filename):
pkt_filename = secure_filename(file.filename)
file.save(os.path.join(app.config['UPLOAD_FOLDER'], pkt_filename))
return jsonify({'filename':'/var/www/html/myapp/packets/' + pkt_filename})
The problem is that I can't figure out where exactly mydomain.com is on the system. In development, I could just do mydomain.com/html/myapp/packets/test.pdf, and it would open in browser, but this doesn't work in deployment. Even though the DocumentRoot is /var/www/html/myapp, typing mydomain.com/packets/test.pdf into the address bar returns a 404 (even though it definitely exists on the system).
Another interesting thing is that os.cwd() in that Python function returns '/', although I'm not sure what the consequences of that are.
Any help?

Requested URL not found with mod_wsgi in Django

I am trying to get django to work on apache with mod_wsgi. My djang.wsgi code is:
import os, sys
sys.path.append('C:/djcode/mysite')
os.environ['DJANGO_SETTINGS_MODULE'] = 'mysite.settings'
import django.core.handlers.wsgi
application = django.core.handlers.wsgi.WSGIHandler()
And my configuration in 'httpd' is:
Alias /static/ "C:/djcode/mysite/static/"
<Directory C:/djcode/mysite/static/>
Order deny,allow
Allow from all
</Directory>
WSGIScriptAlias / C:/djcode/mysite/apache/django.wsgi
<Directory C:/djcode/mysite/apache>
Order deny,allow
Allow from all
</Directory>
Alias /files/ "C:/djcode/mysite/files/"
<Directory C:/djcode/mysite/files/>
Order deny,allow
Allow from all
</Directory>
In the folder 'files' are files where I read data (not databases) which are used to output in templates.
The urls.py code is as follows:
urlpatterns = patterns('',
('^all/$', all),
('^(sport)/$', gen),
('^(teknology)/$', gen),
...
When I start Apache, localhost, the message is "It works!". But when I try localhost/all' or localhost/mysite or localhost/mysite/all, the browser says "The requested URL /all was not found on this server`. I can not understand where does it fail

Where is the definition or class for all? It's technically the controller. Can you post it?
This line routes it:
('^all/$', all)
But we don't know what all is.

Please make sure, you have the VirtualHost configuration correctly setup in the httpd.conf file. Try using localhost first (as the ServerName) and see if it works.

Flask session not persisting

Am running with Python 2.7, Apache + mod_wsgi on CentOS 6.3
Things work fine when I am on localhost. However, when I run the code on a vm in Azure, I do not see the session information being persisted across pages.
Basically in my views, I have something like:
#frontend.route('/')
def index():
session['foo'] = 'bar'
print session['foo']
return redirect(url_for("frontend.page2"))
#frontend.route('page2')
def page2():
print session
The print output is:
bar
<SecureCookieSession {}>
My wsgi configuration for apache is:
WSGISocketPrefix /var/run/wsgi
<VirtualHost *:80>
ServerName example.com
ServerAlias example.com
WSGIDaemonProcess myproj threads=5 processes=5
WSGIScriptAlias / /home/mydir/myproj/apache/myproj.wsgi
<Directory /home/mydir/myproj>
WSGIScriptReloading On
WSGIProcessGroup myproj
WSGIApplicationGroup %{GLOBAL}
Order deny,allow
Allow from all
</Directory>
</VirtualHost>
I have the secret_key set:
app.secret_key = os.urandom(24)
I have tried with both setting SERVER_NAME but it doesn't help:
app.config['SERVER_NAME'] = 'example.com'
Any ideas on how I can debug this more?
Thanks!

Don't use app.secret_key = os.urandom(24)!
You're supposed to enter a static value here, not read from os.urandom each time. You've probably misunderstood the example in the docs, it shows you how you can read random data from os.urandom, but it also clearly states:
Just take that thing and copy/paste it into your code and you’re done
If you read it at runtime, then each of your worker processes will have a different secret key! That means if a request is handled by a different worker, the session will break because the cookie is signed with the wrong secret key.

django urls.py cannot process the url

i am creating a django app, my project name is domain_com and the application name is gallery. The project is mapped to domain.com, so that works, now when i create the urls.py with these redirects its giving me these errors
(r'^domain_com/(?P<page_name>[^/]+)/edit/$', 'domain_com.gallery.views.edit_page'),
(r'^domain_com/(?P<page_name>[^/]+)/save/$', 'domain_com.gallery.views.save_page'),
(r'^domain_com/(?P<page_name>[^/]+)/$', 'domain_com.gallery.views.view_page')
error:
Using the URLconf defined in domain_com.urls, Django tried these URL patterns, in this order:
^domain_com/(?P<page_name>[^/]+)/edit/$
^domain_com/(?P<page_name>[^/]+)/save/$
^domain_com/(?P<page_name>[^/]+)/$
The current URL, edit, didn't match any of these.
any idea where the problem is? my intial install of django worked after create the application, so i am sure its the urls.py
this is my apache config
<VirtualHost *:80>
ServerName www.domain.com
ServerAlias domain.com
DocumentRoot /var/www/www.domain.com/htdocs/
ErrorLog /var/www/www.domain.com/logs/error.log
CustomLog /var/www/www.domain.com/logs/access.log combined
SetHandler mod_python
PythonHandler django.core.handlers.modpython
PythonPath sys.path+['/var/app/virtual/']
SetEnv DJANGO_SETTINGS_MODULE domain_com.settings
SetEnv PYTHON_EGG_CACHE /tmp
<Location "/gallery/">
SetHandler None
</Location>
</VirtualHost>

You have made a complicated URL of the form http://domain.com/domain_com/page_name/edit/. Yet you're testing with the URL http://domain.com/edit. Obviously, those don't match.

after updated my answer:
try this:
(r'^/edit/(?P<page_name>\w+)$', 'gallery.views.edit_page'),
(r'^/save/(?P<page_name>\w+)$', 'gallery.views.save_page'),
(r'^/(?P<page_name>\w+)$', 'gallery.views.view_page')
While urls.py is root folder of your application.
Then if you visit:
http://domain.com/edit/page1
it should work

Set up both your main root urls to include the urls of your apps: https://docs.djangoproject.com/en/dev/topics/http/urls/#including-other-urlconfs