Unsafe redirect to URL with protocol 'account'

Question

I am trying to redirect to login page with return url through a middleware.

I am getting this error so can anyone answer the question why i am getting this error and how to solve this error

from django.shortcuts import redirect
def auth_middleware(get_response):
     def middleware(request):
        print("Middleware")
        return_url = request.META['PATH_INFO']
        if not request.session.get('user_id'):
            return redirect(f'account:login?return_url={return_url}')
        response = get_response(request)
        return response

    return middleware

Answer 1

Django will make a redirect to account:login?return_url=some_url , but the browser does not understand this: since it sees a URL that starts with account: , it assumes that account: is the protocol.

We can reverse the view withreverse(…) [Django-doc] :

from django.urls import reverse
from django.http import HttpResponseRedirect

def auth_middleware(get_response):
     def middleware(request):
        print("Middleware")
        return_url = request.META['PATH_INFO']
        if not request.session.get('user_id'):
            return HttpResponseRedirect(f'{reverse("account:login")}?return_url={return_url}')
        response = get_response(request)
        return response

    return middleware