Django had no CSRF_TRUSTED_ORIGINS and no SECURE_PROXY_SSL_HEADER, so it always treated requests as plain HTTP. Login over HTTPS behind Apache/Nginx failed CSRF verification as a result. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| asgi.py | ||
| settings.py | ||
| urls.py | ||
| wsgi.py | ||
Django had no CSRF_TRUSTED_ORIGINS and no SECURE_PROXY_SSL_HEADER, so it always treated requests as plain HTTP. Login over HTTPS behind Apache/Nginx failed CSRF verification as a result. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| asgi.py | ||
| settings.py | ||
| urls.py | ||
| wsgi.py | ||