Internal
Public Access
Django requires CSRF_TRUSTED_ORIGINS to be set for POST requests (including login) when using HTTPS or non-standard ports. Without this setting, login attempts fail with "CSRF verification failed". The setting is now configurable via CSRF_TRUSTED_ORIGINS environment variable, similar to CORS_ALLOWED_ORIGINS. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>