Session value missing after redirect with django p

Question

I am working on a django project using python-social-auth to do authentication with facebook. I am running the django server on localhost and have facebook set up with my application to redirect to http://127.0.0.1:8000/complete/facebook/, which begins python-social-auth's pipeline to authenticate a user. I am using postgres as my database.

When this method is called and tries to authenticate, it cannot find information on the session. From https://github.com/omab/python-social-auth/issues/534 , I think the sessionid cookie is being overwritten. If I send the facebook redirect to a different url to load a static page without authentication, there is no error but I am also not authenticating or getting any information from facebook.

How would I go about not overwriting the sessionid cookie -if of course, that is the actual issue- or is there another problem that I might be missing here?

[03/Jun/2016 05:19:58] "GET /login/facebook/?next=/lithium-web/ HTTP/1.1" 302 0
Internal Server Error: /complete/facebook/
Traceback (most recent call last):
  File "/Users/mac/Desktop/lithium-web/lib/python2.7/site-packages/django/core/handlers/base.py", line 149, in get_response
    response = self.process_exception_by_middleware(e, request)
  File "/Users/mac/Desktop/lithium-web/lib/python2.7/site-packages/django/core/handlers/base.py", line 147, in get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  File "/Users/mac/Desktop/lithium-web/lib/python2.7/site-packages/django/views/decorators/cache.py", line 57, in _wrapped_view_func
    response = view_func(request, *args, **kwargs)
  File "/Users/mac/Desktop/lithium-web/lib/python2.7/site-packages/django/views/decorators/csrf.py", line 58, in wrapped_view
    return view_func(*args, **kwargs)
  File "/Users/mac/Desktop/lithium-web/lib/python2.7/site-packages/social/apps/django_app/utils.py", line 51, in wrapper
    return func(request, backend, *args, **kwargs)
  File "/Users/mac/Desktop/lithium-web/lib/python2.7/site-packages/social/apps/django_app/views.py", line 28, in complete
    redirect_name=REDIRECT_FIELD_NAME, *args, **kwargs)
  File "/Users/mac/Desktop/lithium-web/lib/python2.7/site-packages/social/actions.py", line 43, in do_complete
    user = backend.complete(user=user, *args, **kwargs)
  File "/Users/mac/Desktop/lithium-web/lib/python2.7/site-packages/social/backends/base.py", line 41, in complete
    return self.auth_complete(*args, **kwargs)
  File "/Users/mac/Desktop/lithium-web/lib/python2.7/site-packages/social/utils.py", line 229, in wrapper
    return func(*args, **kwargs)
  File "/Users/mac/Desktop/lithium-web/lib/python2.7/site-packages/social/backends/facebook.py", line 71, in auth_complete
    state = self.validate_state()
  File "/Users/mac/Desktop/lithium-web/lib/python2.7/site-packages/social/backends/oauth.py", line 88, in validate_state
    raise AuthStateMissing(self, 'state')
AuthStateMissing: Session value state missing.

Answer 1

Solved it by removing LOGIN_REDIRECT_URL from django settings.

Actually python_social_auth pipeline structure sets LOGIN_REDIRECT_URL as next i.e redirect to url, but unfortunately they didn't handled named patterns. So, when we set LOGIN_REDIRECT_URL to myapp:index it produces this error.

So, either remove this setting or use direct patterns i.e

LOGIN_REDIRECT_URL = myapp/index

Answer 2

I also had this problem. Solved it by adding "SOCIAL_AUTH_REDIRECT_IS_HTTPS = True" in my settings.py file, since my configuration is using nginx to redirect to HTTPS. I found this answer only by reading the documentation here: https://python-social-auth-docs.readthedocs.io/en/latest/configuration/settings.html

Answer 3

This error was due to the session cookie not being saved over a non-https url. When testing on localhost with SESSION_COOKIE_SECURE set to True in django, the session cookies will not persist between redirect and you will get this error in any kind of page change where session would be checked.

SESSION_COOKIE_SECURE=False for testing and it's all good