Django 3.2.3访问Admin页面遭遇403 CSRF验证失败求助

错误信息 #

CSRF verification failed. Request aborted.

You are seeing this message because this site requires a CSRF cookie when submitting forms. This cookie is required for security reasons, to ensure that your browser is not being hijacked by third parties.

If you have configured your browser to disable cookies, please re-enable them, at least for this site, or for “same-origin” requests.

配置问题分析 #

你的MIDDLEWARE列表存在重复的django.middleware.common.CommonMiddleware，这会打乱Django中间件的执行顺序，导致CSRF验证流程出错——CSRF中间件依赖Session、Common中间件的正确前置执行顺序。

解决方案 #

1. 修正Middleware顺序，移除重复项 #

删除MIDDLEWARE中第一个django.middleware.common.CommonMiddleware，调整后配置如下：

MIDDLEWARE = [
    'corsheaders.middleware.CorsMiddleware',
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

2. 检查浏览器Cookie设置 #

• 确认浏览器未禁用该站点的Cookie，开启同域请求的Cookie权限
• 清理浏览器缓存及该站点的Cookie后，重新访问Admin后台

3. 验证CSRF相关配置 #

• 若设置了CSRF_COOKIE_DOMAIN，确保其值与站点域名完全匹配
• 本地测试时，使用127.0.0.1或localhost访问，避免使用未配置的自定义域名

内容的提问来源于stack exchange，提问作者Neerav Panchal