[Bug] CSRF token error on logout

[Superredstone]

When logging out via the saml2_logout URL, I consistently get a CSRF token error caused by a null origin. I then need to manually reload the page to proceed.

Forbidden (Origin checking failed - null does not match any trusted origins.): /
[04/Sep/2026 12:05:24] "POST / HTTP/1.1" 403 2538

ACS_DEFAULT_REDIRECT_URL = "/"

LOGOUT_REDIRECT_URL = "/"

SESSION_COOKIE_SECURE = True
SESSION_EXPIRE_AT_BROWSER_CLOSE = True

SAML_SESSION_COOKIE_NAME = "saml_session"
SAML_LOGOUT_REQUEST_PREFERRED_BINDING = saml2.BINDING_HTTP_POST
# Inside of keycloak users get saved as lowercase, this is needed
SAML_DJANGO_USER_MAIN_ATTRIBUTE_LOOKUP = "__iexact"
SAML_USE_NAME_ID_AS_USERNAME = True
SAML_CREATE_UNKNOWN_USER = True
SAML_DEFAULT_BINDING = saml2.BINDING_HTTP_REDIRECT
SAML_ATTRIBUTE_MAPPING = {
    "email": ("email",),
    "givenName": ("first_name",),
    "lastName": ("last_name",),
    "memberOf": ("memberOf",),
}
SAML_CONFIG = {
    "entityid": f"{URL}/saml2/metadata/",
    "name": "myrealm",
    "xmlsec_binary": XMLSEC_BINARY,
    "key_file": KEYCLOAK_KEY_FILE,
    "cert_file": KEYCLOAK_CERT_FILE,
    "attribute_map_dir": str(BASE_DIR / "sso-maps/"),
    "allow_unknown_attributes": False,
    "encryption_keypairs": [
        {
            "key_file": KEYCLOAK_KEY_FILE,
            "cert_file": KEYCLOAK_CERT_FILE,
        }
    ],
    "service": {
        "sp": {
            "name": "Local SP",
            "name_id_format": saml2.saml.NAMEID_FORMAT_TRANSIENT,
            "endpoints": {
                "assertion_consumer_service": [
                    (
                        f"{URL}/saml2/acs/",
                        saml2.BINDING_HTTP_POST,
                    )
                ],
                "single_logout_service": [
                    (f"{URL}/saml2/ls/", saml2.BINDING_HTTP_REDIRECT),
                    (f"{URL}/saml2/ls/post", saml2.BINDING_HTTP_POST),
                ],
            },
            "signing_algorithm": saml2.xmldsig.SIG_RSA_SHA512,
            "digest_algorithm": saml2.xmldsig.DIGEST_SHA512,
            "want_response_signed": True,
            "authn_requests_signed": True,
            "logout_requests_signed": False,
        },
    },
    "metadata": {
        "remote": [
            {"url": f"{KEYCLOAK_URL}/realms/{KEYCLOAK_REALM}/protocol/saml/descriptor"}
        ]
    },
    "debug": ENABLE_DEBUG_SAML,
}