proxy headers

polylan_submitter/polylan_submitter/settings.py

@@ -64,6 +64,26 @@ ALLOWED_HOSTS = [
     if host
 ]
 
+# TLS is terminated by the reverse proxy in front of the container, so daphne
+# only ever sees plain http. Without these, Django compares the browser's
+# `Origin: https://...` against `http://...` and rejects every POST (admin
+# login included) with "CSRF verification failed - Origin checking failed".
+# Full origins with scheme, e.g. "https://submitter.polylan.ch".
+CSRF_TRUSTED_ORIGINS = [
+    origin
+    for origin in (os.environ.get("DJANGO_CSRF_TRUSTED_ORIGINS") or "").split(",")
+    if origin
+]
+
+# Trust the proxy's X-Forwarded-Proto so request.is_secure() /
+# build_absolute_uri() report https. Only safe if the proxy overwrites that
+# header (client-supplied values must not pass through) - opt-in for that
+# reason.
+if os.environ.get("DJANGO_BEHIND_TLS_PROXY", "false").lower() == "true":
+    SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+    CSRF_COOKIE_SECURE = True
+    SESSION_COOKIE_SECURE = True
+
 
 # Application definition