Django POST listener in Elastic Beanstalk to receive AWS Worker Tier requests

Question

I'm trying to set up a Worker Environment to run a background task. I have the same application version running on two Environments, one is the web server and the other one is the Worker.

I need to delete files periodically according to expiration date. I've mapped a view to be the URL on localhost where messages will be forwarded as HTTP POST requests . The task is being scheduled and seems like SQS is running but the messages are all at the WorkerDeadLetterQueue .

At the log file I got the requests being made but a 403 error:

/var/log/httpd/access_log:

"POST /networks_app/delete_expired_files HTTP/1.1" 403 2629 "-" "aws-sqsd/2.0"

and this at /var/log/aws-sqsd/default.log :

message: sent to %[ http://localhost:80/networks_app/delete_expired_files] 2016-01-23T14:58:05Z http-err: d5f645cf-ce15-40bc-8ee3-34acb79e797b (4) 403 - 0.007

Here is my views.py code:

def delete_expired_files(request):
    if request.method == 'POST':
        users = DemoUser.objects.all()
        for user in users:
            documents = Document.objects.filter(owner=user.id)
            if documents:
                for doc in documents:
                    now = timezone.now()
                    if now >= doc.date_published + timedelta(days = doc.owner.group.valid_time):
                        doc.delete()

The cron.yaml file:

version: 1
cron:
 - name: "delete_expired_files"
   url: "/networks_app/delete_expired_files"   
   schedule: "* * * * *" 

If I access the URL via browser it works, It shows a GET request at the log_file of my web application server.

What should I do to make the Worker Environment execute the task?
Why when the Worker tries to send a message, it returns a 403 error?
Is it related to the role permissions?
Should I code a specific listener in Django?
Is using celery the best way to solve this issue?

Answer 1

The internal SQS daemon that creates the POST request does not include a CSRF token, which can lead to '403 Forbidden' errors.

A potential workaround for this is to mark the method as csrf_exempt:

from django.http import HttpResponse
from django.views.decorators.csrf import csrf_exempt

@csrf_exempt
def index(request):
    return HttpResponse("hello, world")