From 6e7a68d509b0cbd4babf3662bea00c9291dcd1dd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Gremaud?= Date: Fri, 23 Oct 2026 18:38:48 +0200 Subject: [PATCH] proxy headers --- deploy/docker/polylan-submitter.env.dist | 2 ++ .../polylan_submitter/settings.py | 20 +++++++++++++++++++ 2 files changed, 22 insertions(+) diff --git a/deploy/docker/polylan-submitter.env.dist b/deploy/docker/polylan-submitter.env.dist index 0f05051..152a65c 100644 --- a/deploy/docker/polylan-submitter.env.dist +++ b/deploy/docker/polylan-submitter.env.dist @@ -16,6 +16,8 @@ DJANGO_SECRET_KEY= DJANGO_DEBUG=false DJANGO_ALLOWED_HOSTS=submitter.polylan.ch +DJANGO_CSRF_TRUSTED_ORIGINS=https://polylan-submitter.legrems.xyz +DJANGO_BEHIND_TLS_PROXY=true POSTGRES_DB= POSTGRES_USER= diff --git a/polylan_submitter/polylan_submitter/settings.py b/polylan_submitter/polylan_submitter/settings.py index 2ebdc99..9a2bffb 100644 --- a/polylan_submitter/polylan_submitter/settings.py +++ b/polylan_submitter/polylan_submitter/settings.py @@ -64,6 +64,26 @@ ALLOWED_HOSTS = [ if host ] +# TLS is terminated by the reverse proxy in front of the container, so daphne +# only ever sees plain http. Without these, Django compares the browser's +# `Origin: https://...` against `http://...` and rejects every POST (admin +# login included) with "CSRF verification failed - Origin checking failed". +# Full origins with scheme, e.g. "https://submitter.polylan.ch". +CSRF_TRUSTED_ORIGINS = [ + origin + for origin in (os.environ.get("DJANGO_CSRF_TRUSTED_ORIGINS") or "").split(",") + if origin +] + +# Trust the proxy's X-Forwarded-Proto so request.is_secure() / +# build_absolute_uri() report https. Only safe if the proxy overwrites that +# header (client-supplied values must not pass through) - opt-in for that +# reason. +if os.environ.get("DJANGO_BEHIND_TLS_PROXY", "false").lower() == "true": + SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https") + CSRF_COOKIE_SECURE = True + SESSION_COOKIE_SECURE = True + # Application definition