Thanks @andre for the idea. I have seen the stuff from django-cors-headers and use that app in my app. However, I can't help, but feel like changing the *request.MEA['HTTP_REFERER']* feels way to hacky for my liking. I know this would work as a workaround until the ticket that @ramiromorales pointed it is completed (thanks @ramiromorales for pointing that out):
- https://github.com/django/django/pull/4337 Would be happy to help with that ticket where possible! Good to see it's getting resolved! Troy On Friday, May 29, 2015 at 4:11:24 AM UTC-6, Ramiro Morales wrote: > > On Fri, May 29, 2015 at 12:41 AM, Troy Grosfield > <troy.gr...@gmail.com <javascript:>> wrote: > > > > I have the following domain and subdomains both are trusted and both are > secure (https): > > > > https://example.com > > https://api.example.com > > > > When making POST ajax request from https://example.com to > https://api.example.com I see the following error message: > > > > detail: "CSRF Failed: Referer checking failed - > https://example.com/path/to/some/url does not match > https://api.example.com/."; > > > > > > Which takes me to the CsrfViewMiddleware where I see same_origin > checking: > > > > # Note that request.get_host() includes the port. > > good_referer = 'https://%s/' % request.get_host() > > if not same_origin(referer, good_referer): > > reason = REASON_BAD_REFERER % (referer, good_referer) > > return self._reject(request, reason) > > > > I trust my subdomain, but there's no way for this code to actually pass > this validation. Am I just missing something? Why would trusted > subdomains fail validation here? Can't this at least be a setting > something like TRUSTED_SUBDOMAINS that's also checked? > > See ticket [1]24496, it's associated [2]PR and e.g. thios [3]comment. > > Any help in advancing the issue (e.g. reviewing the patch and adding > the missing documentation changes) is welcome. > > > 1. https://code.djangoproject.com/ticket/24496 > 2. https://github.com/django/django/pull/4337/files > 3. https://code.djangoproject.com/ticket/16010#comment:3 > > -- > Ramiro Morales > @ramiromorales > -- You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group. To unsubscribe from this group and stop receiving emails from it, send an email to django-developers+unsubscr...@googlegroups.com. To post to this group, send email to django-developers@googlegroups.com. Visit this group at http://groups.google.com/group/django-developers. To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/739a0c21-5ce7-452b-9a89-8b1c5cd35e34%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
