From 695109e447c39d0f685736290a43ee76a7972d0b Mon Sep 17 00:00:00 2001 From: Keith Smith Date: Fri, 26 Dec 2025 17:10:14 -0700 Subject: [PATCH] Add CSRF_TRUSTED_ORIGINS setting for self-hosted deployments MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Django requires CSRF_TRUSTED_ORIGINS to be set for POST requests (including login) when using HTTPS or non-standard ports. Without this setting, login attempts fail with "CSRF verification failed". The setting is now configurable via CSRF_TRUSTED_ORIGINS environment variable, similar to CORS_ALLOWED_ORIGINS. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 --- config/settings/selfhosted.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/config/settings/selfhosted.py b/config/settings/selfhosted.py index bc47dd6..31b9450 100644 --- a/config/settings/selfhosted.py +++ b/config/settings/selfhosted.py @@ -93,6 +93,13 @@ CORS_ALLOWED_ORIGINS = os.environ.get( 'http://localhost:8000' ).split(',') +# CSRF - configurable for self-hosted +# Must include the exact URL (with protocol and port) you're accessing the site from +CSRF_TRUSTED_ORIGINS = os.environ.get( + 'CSRF_TRUSTED_ORIGINS', + 'http://localhost:8000' +).split(',') + # Static files STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'