Why does DEBUG=False setting make my django Static Files Access fail?

Question

Am building an app using Django as my workhorse. All has been well so far - specified db settings, configured static directories, urls, views etc. But trouble started sneaking in the moment I wanted to render my own beautiful and custom 404.html and 500.html pages.

I read the docs on custom error handling, and set necessary configurations in UrlsConf, created corresponding views and added the 404.html and the 500.html to my app's template directory (specified in the settings.py too).

But the docs say you can actually view custom error views until Debug is Off, so I did turn it off to test my stuff, and that's when stuff goes berserk!

Not only do I fail to view the custom 404.html (actually, it loads, but because my error pages each contain a graphic error message -as some nice image), the source of the error page loads, but nothing else loads! Not even linked CSS or Javascript!

Generally, once I set DEBUG = False, all views will load, but any linked content (CSS, Javascript, Images, etc) wont load! What's happening? Is there something am missing, concerning static files and the DEBUG setting?

Rambler

How are you hosting? Local machine with the test server? – Hying

local machine with test server. I basically want to see how my custom error handling would work by locally simulating scenarios such as accessing non-existing pages and causing run-time errors - but my static content wont load. – Rambler

Either it can be done at server level like here or it can be handled at Django level by adding urlpattern. I found this below question for the same problem. #6405673 – Gauzy

Answer 1

With debug turned off Django won't handle static files for you any more - your production web server (Apache or something) should take care of that.

Frederiksen

This actually settles my curiosity, so now it makes sense, and i can indeed take care of it with Apache if need be then. I'd thought it was a problem with my own settings. Thanks – Rambler

I found this answer very helpful. Just in case someone else is in my same situation (using Google App Engine for the app with nonrel django): don't forget to update app.yaml. – Olmsted

handlers: - url: /static static_dir: static – Olmsted

Doesn't make sense to me. I would like to test it locally somehow with Debug=False – Eccrine

@PhilippS. It doesn't matter you can also test it with Debug=False and an local Apache server (not using ./manage.py runserver but a locally run Apache server). – Forebode

This package solved the issue for me: whitenoise.evans.io/en/stable – Dezhnev

manage.py runserver --insecure works for serving static files with debug=True – Frantic

Answer 2

If you still need to server static locally (e.g. for testing without debug) you can run devserver in insecure mode:

manage.py runserver --insecure

Cullis

@astrocybernaute make sure you have staticfiles app installed – Cullis

Whilst this flag does work, it does not serve the content from the collectstatic folder – Optometrist

That's magic. Thank you sir, you're a hero. This answer should be merged with the accepted answer as it solves the problem without having to serve static using another way than django itself. – Nodical

This was all I needed. Although the best practice would be to use environment variable to differentiate between development and production environment and Debug toggle. – Ratite

Please note: that's will NOT work with ManifestStaticFilesStorage as code.djangoproject.com/ticket/19295 – Aestheticism

can someone tell me though what is so insecure about this – Hague

@KaviVaidya - It's only insecure because it hasn't been carefully checked to have confidence that it is secure. See https://mcmap.net/q/75102/-why-is-serving-static-files-insecure for details. IMHO this is a really poor choice of naming, conflating FUD about security with clear performance limitations. – Devito

It throws this error: manage.py runserver: error: unrecognized arguments: --insecure – Tressietressure

It seems it's not an option any more on Django 3.1. There is no --insecure in help and adding it does nothing. Seems we now need gunicorn, nginx and so on for prod – Bulwark

@Devito It's not FUD - it's really less secure. There is no focus on security for this server. Not saying it's designed insecurely, but it doesn't receive the same rigorous security testing that webservers have. And when it's breached you're very likely to land in a directory with write privileges and access to the application code. A well-configured image server doesn't suffer from these extra weaknesses. – Disyllable

Well,it's still in django 3.2 and django3.1's official guide. docs.djangoproject.com/en/3.2/ref/contrib/staticfiles/… – Gt

If 'daphne' is installed apps, you won't be able to use --insecure flag since Daphne overrides runserver command thus removing the ability to serve static files. If you are just debugging to see how templates will look like, you may remove Daphne temporarily. – Soften

Answer 3

First you need to add STATIC_ROOT in your settings.py.

STATIC_ROOT = BASE_DIR / 'static'

Make sure BASE_DIR is already defined.

Then you'll need to add following code in you app's root urls.py.

from django.urls import re_path
from django.views.static import serve
from django.conf import settings


urlpatterns = [
    # your other paths here
    re_path(r'^media/(?P<path>.*)$', serve,{'document_root': settings.MEDIA_ROOT}),
    re_path(r'^static/(?P<path>.*)$', serve,{'document_root': settings.STATIC_ROOT}),
]

Then you'll need to run:

python manage.py collectstatic

Lastly run:

python manage.py runserver

and now you should be able to load your static files.

Zoogeography

AWESOME! Don't forget to set STATIC_ROOT and manage.py collectstatic. – Miser

Nowadays replace url( with re_path( – Devito

This actually works while the app is in local but it wont work after it gets deployed – Oviposit

its really cool.. I am using this for my project which only installed in local machine... thanks a ton! – English

where to import settings from ? – Bosomy

Answer 4

You can use WhiteNoise to serve static files in production.

Install:

pip install WhiteNoise==2.0.6

And change your wsgi.py file to this:

from django.core.wsgi import get_wsgi_application
from whitenoise.django import DjangoWhiteNoise

application = get_wsgi_application()
application = DjangoWhiteNoise(application)

And you're good to go!

Credit to Handlebar Creative Blog.

BUT, it's really not recommended serving static files this way in production. Your production web server(like nginx) should take care of that.

Anaglyph

Sounds interesting, but didn't work for me by just adding that line to the wgsi.py file. The documentation you linked seems to give other instructions for using WhiteNoise. Will try other ways and update you here. – Supernatural

+1 as this was what eventually led me to the solution. I added an answer where I included the additional steps I took to actually make it work. – Supernatural

manage.py runserver --insecure didn't work for me. This one does, though. – Weems

Note that with WhiteNoise release 4.0, the configuration changed. Do not add these lines to wsgi.py. Instead, just add 'whitenoise.middleware.WhiteNoiseMiddleware' to middleware. See release notes from the changelog – Hartzog

Why is *not recommended? I've been using it for years in several sites, works great. Even Heroku uses it in their Django template. – Strati

how about asgi? Thanks! – Polythene

@OmarGonzalez for your question, please refer Marek answer https://mcmap.net/q/73836/-why-does-debug-false-setting-make-my-django-static-files-access-fail this answer is old(2016) and next sentence has explain why not recommanded – Hinshelwood

Answer 5

Johnny's answer is great, but still didn't work for me just by adding those lines described there. Based on that answer, the steps that actually worked for me where:

1. Install WhiteNoise as described:

   pip install WhiteNoise
   

2. Create the STATIC_ROOT variable and add WhiteNoise to your MIDDLEWARE variable in settings.py:

   #settings.py
   MIDDLEWARE = [
       'django.middleware.security.SecurityMiddleware',
       'whitenoise.middleware.WhiteNoiseMiddleware', #add whitenoise
       'django.contrib.sessions.middleware.SessionMiddleware',
       ...
   ]
   
   #...
   
   STATIC_ROOT = os.path.join(BASE_DIR, 'staticfiles') ##specify static root
   

3. Then, modify your wsgi.py file as explained in Johnny's answer:

   #wsgi.py
   from django.core.wsgi import get_wsgi_application
   from whitenoise.django import DjangoWhiteNoise
   
   application = get_wsgi_application()
   application = DjangoWhiteNoise(application)
   

4. After that, deploy your changes to your server (with git or whatever you use).

5. Finally, run the collectstatic option from your manage.py on your server. This will copy all files from your static folders into the STATIC_ROOT directory we specified before:

   $ python manage.py collectstatic
   

   You will now see a new folder named staticfiles that contains such elements.

After following these steps you can now run your server and will be able to see your static files while in Production mode.

Update: In case you had version < 4 the changelog indicates that it's no longer necessary to declare the WSGI_APPLICATION = 'projectName.wsgi.application' on your settings.py file.

Supernatural

I did it accordingly, and on development it served fine, but not in production. Still have the same issue when DEBUG == False – Abbey

@AnnaHuang What do you mean by in development and in production? Do you have separate environments or machines? Are they configured the same way? – Supernatural

@Supernatural did you mean "version > 4"? – Johnsten

@AnnaHuang did you checkout the Update at the bottom of this post? After I deleted the "WSGI_APPLICATION" setting it started working in production. – Johnsten

Answer 6

If you are using the static serve view in development, you have to have DEBUG = True :

Warning

This will only work if DEBUG is True.

That's because this view is grossly inefficient and probably insecure. This is only intended for local development, and should never be used in production.

Docs: serving static files in developent

• Updated link, and this

EDIT: You could add some urls just to test your 404 and 500 templates, just use the generic view direct_to_template in your urls.

from django.views.generic.simple import direct_to_template

urlpatterns = patterns('',
    ('^404testing/$', direct_to_template, {'template': '404.html'})
)

Hying

you would set up your web server to host a specific directory. Most commonly you'd be using Apache or Nginx. The Docs go into it a bit. – Hying

thanks @j_syk, I’d already tried this approach of viewing the 404.html and 500.html via some other non-error mechanism similar to what u suggest. But i wanted to know whether it was totally impossible to have my pages render correctly as they would in production, while still merely running on my testing server - the delegation of static file handling to Apache when Debug is Off settles it for me. Thanks for contributing. – Rambler

@mcnemesis I'm not sure exactly what will happen- but try setting TEMPLATE_DEBUG=False, and DEBUG=True. If you turn off the pretty errors I'm not sure if it goes to the 404/500 templates instead – Hying

like expected, doing this didn't yield any positive results.But thanks still. – Rambler

Answer 7

You actually can serve static files in a production Django app, securely and without DEBUG=True.

Rather than using Django itself, use dj_static in your WSGI file (github):

requirements.txt:

...
dj-static==0.0.6

YOURAPP/settings.py:

...
STATIC_ROOT = 'staticdir'
STATIC_URL = '/staticpath/'

YOURAPP/wsgi.py:

...
from django.core.wsgi import get_wsgi_application
from dj_static import Cling

application = Cling(get_wsgi_application())

Ethelynethene

I've since discovered whitenoise, which may be more full-featured. – Ethelynethene

Answer 8

From here I took help by mixing a few answers. Here, I am adding my whole parts. [I am doing this for a beginners help and for my future use as well]

Well at first the question is why Debug=False needed! I put my project in AWS and it was being connection timeout after few hours because of memory leaking. At first I thought for celery. [of course I am just a beginner] Then I put DEBUG=False from DEBUG=True As we can see the security warning in settings.py

# SECURITY WARNING: don't run with debug turned on in production!
DEBUG = True

Once I did that my staticfiles were not loading successfully in webpages. Then I searched everywhere and at first tried from here the --insecure command to runserver.

python manage.py runserver --insecure

Which is successful but I don't want the insecure mode in my project when it is in production. And as the proper solution [according to me] I followed the steps below.

At first, I correct the static URL,root, and dir in settings.py

STATIC_URL = '/static/'
STATICFILES_DIRS = [os.path.join(BASE_DIR, 'static')]
STATIC_ROOT = os.path.join(BASE_DIR, 'staticfiles')

Then collect the static files by command

python manage.py collectstatic

Now the second step, [which also provided here] At first install whitenoise in your project directory in the command line

pip install whitenoise

Then Add 'whitenoise.middleware.WhiteNoiseMiddleware' in your middleware list in settings.py.

This should be added just below the 'django.middleware.security.SecurityMiddleware' and above all the remaining middleware. So that your middleware list will look like this:-

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware', #after this line
    'whitenoise.middleware.WhiteNoiseMiddleware', #add it exactlyhere
    'django.contrib.sessions.middleware.SessionMiddleware', #before this
    '...'
]

Add 'whitenoise.runserver_nostatic' on top of your installed apps So that your installed apps list will look like this:-

INSTALLED_APPS = [
    'whitenoise.runserver_nostatic',
    'django.contrib.admin',
    'django.contrib.auth',
    '...'
]

Done, you will be able to serve static files in production now!! [I did on my local environment as well]

Just use the runserver command as always no insecure or anything needed.

python manage.py runserver

Boom!!! It's working for me. Hahaha. I know kinda childish nature but I am so happy now.

Thanks to everyone who provided answers here and help my work.

Condescendence

Answer 9

Ultimate solution:-
So basically when you make debug = False, Django doesn't want to take care of your static files.
So we want something that can take care of our files.
The answer is whitenoise.

1. pip install whitenoise in your environment
   
   

2. Add 'whitenoise.middleware.WhiteNoiseMiddleware' in your middleware list in settings.py.

   This should be added just below the 'django.middleware.security.SecurityMiddleware' and above all the remaining middleware. So that your middleware list will look like this:-

   MIDDLEWARE = [
       'django.middleware.security.SecurityMiddleware',
       'whitenoise.middleware.WhiteNoiseMiddleware',
       # add it exactlyhere
       'django.contrib.sessions.middleware.SessionMiddleware',
       '...'
   ]
   

3. Add 'whitenoise.runserver_nostatic' on top of your installed apps So that your installed apps list will look like this:-

   INSTALLED_APPS = [
       'whitenoise.runserver_nostatic',
       'django.contrib.admin',
       'django.contrib.auth',
       '...'
   ]
   

Done, you will be able to serve static files in production now!!

Peccadillo

thanks a lot. it worked for me. But if someone just following this then plz at first collect the static files. – Condescendence

Answer 10

You can debug this in many different ways. Here's my approach.

localsettings.py:

DEBUG = False
DEBUG404 = True

urls.py:

from django.conf import settings
import os

if settings.DEBUG404:
    urlpatterns += patterns('',
        (r'^static/(?P<path>.*)$', 'django.views.static.serve',
         {'document_root': os.path.join(os.path.dirname(__file__), 'static')} ),
    )

Be sure to read the docs ;)

https://docs.djangoproject.com/en/2.0/howto/static-files/#limiting-use-to-debug-true

Contextual

Thanks it worked for me by only adding the: DEBUG = False DEBUG404 = True – Stricklin

Answer 11

For last versions of Django please look at the answer here: https://mcmap.net/q/73836/-why-does-debug-false-setting-make-my-django-static-files-access-fail

For django version below 1.10 the solution should work:

Just open your project urls.py, then find this if statement.

if settings.DEBUG:
    urlpatterns += patterns(
        'django.views.static',
        (r'^media/(?P<path>.*)','serve',{'document_root': settings.MEDIA_ROOT}), )

You can change settings.DEBUG on True and it will work always. But if your project is a something serious then you should to think about other solutions mentioned above.

if True:
    urlpatterns += patterns(
        'django.views.static',
        (r'^media/(?P<path>.*)','serve',{'document_root': settings.MEDIA_ROOT}), )

In django 1.10 you can write so:

urlpatterns += [ url(r'^media/(?P<path>.*)$', serve, { 'document_root': settings.MEDIA_ROOT, }), url(r'^static/(?P<path>.*)$', serve, { 'document_root': settings.STATIC_ROOT }), ]

Thud

Your code is correct, but in Django 1.10, the configuration is for media and static is: urlpatterns += [ url(r'^media/(?P<path>.*)$', serve, { 'document_root': settings.MEDIA_ROOT, }), url(r'^static/(?P<path>.*)$', serve, { 'document_root': settings.STATIC_ROOT }), ] – Symposium

Answer 12

This is Exactly you must type on terminal to run your project without DEBUG = TRUE and then you see all assets (static) file is loading correctly On local server .

python manage.py runserver --insecure 

--insecure : it means you can run server without security mode

Lundin

easiest answer. adding middleware just to debug 404 styles in development is an overkill. funny thing is i went looking for this flag but could find no mention of it on django's manage.py documentation page – Bookcase

Answer 13

I agree with Marek Sapkota answer; But you can still use django URFConf to reallocate the url, if static file is requested.

Step 1: Define a STATIC_ROOT path in settings.py

STATIC_ROOT = os.path.join(BASE_DIR, 'staticfiles')

Step 2: Then collect the static files

$ python manage.py collectstatic

Step 3: Now define your URLConf that if static is in the beginning of url, access files from the static folder staticfiles. NOTE: This is your project's urls.py file:

from django.urls import re_path
from django.views.static import serve

urlpattern += [
  re_path(r'^static/(?:.*)$', serve, {'document_root': settings.STATIC_ROOT, })
]

Archdeacon

Answer 14

when i make DEBUG = True my static are doesn't work.

if i run my project in python manage.py runserver --insecure . By this i got my static as well.

Solution 1:

python manage.py runserver --insecure

Solution 2:

But I Need Permanent Solution. then i install pip install dj-static==0.0.6 and add some code to my wsgi.py file:

from django.core.wsgi import get_wsgi_application
from dj_static import Cling

application = Cling(get_wsgi_application())

and then i added some in setting.py:

STATIC_URL = '/static/'
STATIC_ROOT = os.path.join(BASE_DIR, '/static/')
STATICFILES_DIRS = [
    BASE_DIR / "static",
]

Tudor

Answer 15

nginx,settings and url configs

If you're on linux this may help.

nginx file

your_machn:/#vim etc/nginx/sites-available/nginxfile

server {
    server_name xyz.com;

    location = /favicon.ico { access_log off; log_not_found off; }
    location /static/ {
        root /var/www/your_prj;
    }

    location /media/ {
        root /var/www/your_prj;
    }
...........
......
}

urls.py

.........
   .....
    urlpatterns = [
        path('admin/', admin.site.urls),
        path('test/', test_viewset.TestServer_View.as_view()),
        path('api/private/', include(router_admin.urls)),
        path('api/public/', include(router_public.urls)),    
        ]
    
    if settings.DEBUG:
        import debug_toolbar
        urlpatterns += static(settings.MEDIA_URL,document_root=settings.MEDIA_ROOT)
        urlpatterns += static(settings.STATIC_URL, document_root=settings.STATIC_ROOT)

settings.py

.....
........
STATIC_URL = '/static/'
MEDIA_URL = '/media/'

STATIC_ROOT = os.path.join(BASE_DIR, 'static/')
MEDIA_ROOT = os.path.join(BASE_DIR, 'media')
.....
....

Ensure to run:

(venv)yourPrj$ ./manage.py collectstatic
yourSys# systemctrl daemon-reload

Ecthyma

Answer 16

This is normal and intended behavior.

Warning

This will only work if DEBUG is True.  
you can actually view custom error views until Debug is Off  

If Django is just reading from the filesystem and sending out a file, then it has no advantage over a normal web server, all web servers are capable to server the files on it's own.

Furthermore, if you serve static files with Django, you will keep the Python process busy for the duration of the request and it will be unable to serve the dynamic requests to which it is more suited.

For these reasons, the Django static view is designed only for use during development and will not work if your DEBUG setting is False.

Since during development we only usually have one person accessing the site at a time (the developer), Django is fine to serve static files.

Advisory

Answer 17

I got this problem today and this fixed it while on development, If you still need to server static locally (e.g. for testing without debug) you can run devserver in insecure mode:

manage.py runserver --insecure

Don't worry because when in production, this hosting platform (Apache, Heroku E.T.C ) would handle serving the static files for you.

Note: Heroku Doesn't server static files, you'd want to put it on AWS or MS Azure

Impresa

Answer 18

Support for string view arguments to url() is deprecated and will be removed in Django 1.10

My solution is just small correction to Conrado solution above.

from django.conf import settings
import os
from django.views.static import serve as staticserve

if settings.DEBUG404:
    urlpatterns += patterns('',
        (r'^static/(?P<path>.*)$', staticserve,
            {'document_root': os.path.join(os.path.dirname(__file__), 'static')} ),
        )

Demakis

Answer 19

I did the following changes to my project/urls.py and it worked for me

Add this line : from django.conf.urls import url

and add : url(r'^media/(?P<path>.*)$', serve, {'document_root': settings.MEDIA_ROOT, }), in urlpatterns.

Botti

Answer 20

In production mode, the static files are no longer served by Django, but rather they should be served by Apache or NGINX, and hence you will need to configure them.

On the other hand, in case you wanted to let Django serve them, then the code below helps to let the static files be served by Django when DEBUG=False.

You can try it by appending the code below to the main urls.py file:

from django.urls import re_path
from django.views.static import serve


urlpatterns += (
re_path(r'^media/(?P<path>.*)$', serve,{'document_root': settings.MEDIA_ROOT}),
re_path(r'^static/(?P<path>.*)$', serve,{'document_root': settings.STATIC_ROOT}),
)

Then, do "collectstatic":

python manage.py collectstatic

Credit to @stathoula. Following her answer along with the remark of @leopd (adding re_path to her answer).

Giorgia

As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center. – Conard

Answer 21

Although it's not safest, but you can change in the source code. navigate to Python/2.7/site-packages/django/conf/urls/static.py

Then edit like following:

if settings.DEBUG or (prefix and '://' in prefix):

So then if settings.debug==False it won't effect on the code, also after running try python manage.py runserver --runserver to run static files.

NOTE: Information should only be used for testing only

Josephinejosephson