[Django 4.2] Django>=4.0 must include both scheme and host in CSRF_TRUSTED_ORIGINS - Githubissues

openedx / edx-platform

The Open edX LMS & Studio, powering education sites around the world!

https://openedx.org

GNU Affero General Public License v3.0

7.44k stars 3.88k forks source link

[Django 4.2] Django>=4.0 must include both scheme and host in CSRF_TRUSTED_ORIGINS #33228

Open UsamaSadiq opened 1 year ago

UsamaSadiq commented 1 year ago

Django 4.0 and above

For Django 4.0 and above, CSRF_TRUSTED_ORIGINS must include scheme and host, e.g.:
```
https://dummy.example.com
```

Django 3.2 and lower

For Django 3.2 and lower, CSRF_TRUSTED_ORIGINS must contain only the hostname, without a scheme:
```
.example.com
```
Reference release notes documentation
https://docs.djangoproject.com/en/3.2/ref/settings/#csrf-trusted-origins
https://docs.djangoproject.com/en/4.0/ref/settings/#csrf-trusted-origins Further details on this change can be read in https://forum.djangoproject.com/t/django-4-0-wildcard-subdomain-preventing-from-setting-csrf-token/11599/28.

awais786 commented 1 year ago

Facing this issue on sandboxes with django42.