Django POST listener in Elastic Beanstalk to receive AWS Worker Tier requests

Question

I'm trying to set up a Worker Environment to run a background task. I have the same application version running on two Environments, one is the web server and the other one is the Worker.

I need to delete files periodically according to expiration date. I've mapped a view to be the URL on localhost where messages will be forwarded as HTTP POST requests. The task is being scheduled and seems like SQS is running but the messages are all at the WorkerDeadLetterQueue.

At the log file I got the requests being made but a 403 error:

/var/log/httpd/access_log:

"POST /networks_app/delete_expired_files HTTP/1.1" 403 2629 "-" "aws-sqsd/2.0"

and this at /var/log/aws-sqsd/default.log:

message: sent to %[http://localhost:80/networks_app/delete_expired_files] 2016-01-23T14:58:05Z http-err: d5f645cf-ce15-40bc-8ee3-34acb79e797b (4) 403 - 0.007

Here is my views.py code:

def delete_expired_files(request):
    if request.method == 'POST':
        users = DemoUser.objects.all()
        for user in users:
            documents = Document.objects.filter(owner=user.id)
            if documents:
                for doc in documents:
                    now = timezone.now()
                    if now >= doc.date_published + timedelta(days = doc.owner.group.valid_time):
                        doc.delete()

The cron.yaml file:

version: 1
cron:
 - name: "delete_expired_files"
   url: "/networks_app/delete_expired_files"   
   schedule: "* * * * *" 

If I access the URL via browser it works, It shows a GET request at the log_file of my web application server.

What should I do to make the Worker Environment execute the task?
Why when the Worker tries to send a message, it returns a 403 error?
Is it related to the role permissions?
Should I code a specific listener in Django?
Is using celery the best way to solve this issue?

Answer 1

The internal SQS daemon that creates the POST request does not include a CSRF token, which can lead to '403 Forbidden' errors.

A potential workaround for this is to mark the method as csrf_exempt:

from django.http import HttpResponse
from django.views.decorators.csrf import csrf_exempt

@csrf_exempt
def index(request):
    return HttpResponse("hello, world")