proxy headers

deploy/docker/polylan-submitter.env.dist

@@ -16,6 +16,8 @@
 DJANGO_SECRET_KEY=
 DJANGO_DEBUG=false
 DJANGO_ALLOWED_HOSTS=submitter.polylan.ch
+DJANGO_CSRF_TRUSTED_ORIGINS=https://polylan-submitter.legrems.xyz
+DJANGO_BEHIND_TLS_PROXY=true
 
 POSTGRES_DB=
 POSTGRES_USER=

polylan_submitter/polylan_submitter/settings.py

@@ -64,6 +64,26 @@ ALLOWED_HOSTS = [
     if host
 ]
 
+# TLS is terminated by the reverse proxy in front of the container, so daphne
+# only ever sees plain http. Without these, Django compares the browser's
+# `Origin: https://...` against `http://...` and rejects every POST (admin
+# login included) with "CSRF verification failed - Origin checking failed".
+# Full origins with scheme, e.g. "https://submitter.polylan.ch".
+CSRF_TRUSTED_ORIGINS = [
+    origin
+    for origin in (os.environ.get("DJANGO_CSRF_TRUSTED_ORIGINS") or "").split(",")
+    if origin
+]
+
+# Trust the proxy's X-Forwarded-Proto so request.is_secure() /
+# build_absolute_uri() report https. Only safe if the proxy overwrites that
+# header (client-supplied values must not pass through) - opt-in for that
+# reason.
+if os.environ.get("DJANGO_BEHIND_TLS_PROXY", "false").lower() == "true":
+    SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+    CSRF_COOKIE_SECURE = True
+    SESSION_COOKIE_SECURE = True
+
 
 # Application definition