From d458cd3673fc62818aa064a66897c662a2c072cd Mon Sep 17 00:00:00 2001 From: peter Date: Wed, 2 Sep 2026 12:17:16 +0100 Subject: [PATCH] Fix CSRF failure behind a TLS-terminating reverse proxy Django had no CSRF_TRUSTED_ORIGINS and no SECURE_PROXY_SSL_HEADER, so it always treated requests as plain HTTP. Login over HTTPS behind Apache/Nginx failed CSRF verification as a result. --- daybook_project/settings.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/daybook_project/settings.py b/daybook_project/settings.py index 3b396a6..db820ce 100644 --- a/daybook_project/settings.py +++ b/daybook_project/settings.py @@ -9,6 +9,12 @@ SECRET_KEY = os.environ.get("DJANGO_SECRET_KEY", "dev-only-change-me") DEBUG = os.environ.get("DJANGO_DEBUG", "1").lower() in {"1", "true", "yes", "on"} ALLOWED_HOSTS = [host.strip() for host in os.environ.get("DJANGO_ALLOWED_HOSTS", "*").split(",") if host.strip()] +# Needed when running behind a TLS-terminating reverse proxy (Apache/Nginx/etc.): +# Django otherwise thinks every request is plain HTTP, which breaks CSRF checks +# on login/POST. The proxy must forward X-Forwarded-Proto: https. +CSRF_TRUSTED_ORIGINS = [origin.strip() for origin in os.environ.get("DJANGO_CSRF_TRUSTED_ORIGINS", "").split(",") if origin.strip()] +SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https") + INSTALLED_APPS = [ "django.contrib.admin", "django.contrib.auth",