translate.moonfin.io: sign-up fails with "CSRF verification failed – Origin checking failed - null does not match any trusted origins"

[leonardopieralli]

I'd like to contribute an Italian translation on translate.moonfin.io, but I can't create an account there.

What happens

1. Open translate.moonfin.io and go to Register
2. Pass the Cloudflare check
3. Sign up with Google, with GitHub or with email: every method ends on Django's CSRF error page:

CSRF verification failed. Request aborted.
Origin checking failed - null does not match any trusted origins.

Tried several times, with the same result each time. The Cloudflare check itself passes (see #1707 for why it is there); the error comes after it.

Likely cause

The browser sends Origin: null on the form post, probably because of the redirect through the Cloudflare challenge (or a Referrer-Policy / sandboxed context in front of Weblate), and Django rejects it. It may be worth checking CSRF_TRUSTED_ORIGINS (WEBLATE_CSRF_TRUSTED_ORIGINS in the Docker image) and the proxy / Cloudflare settings in front of the sign-up pages.

Italian translation

In the meantime I have an Italian translation ready: an app_it.arb with 2084 strings that app_it.arb on Weblate doesn't have yet or that I reviewed, using a consistent glossary. It passes flutter gen-l10n with no errors. I'm happy to upload it on Weblate once I can register, or to send the file in whatever way suits you best (attached here, a PR, or an upload by a Weblate admin), so it doesn't bypass your Weblate workflow.

---

Prepared with the help of an AI assistant (Claude Code).

🤖 Generated with Claude Code

[RadicalMuffinMan]

Signing up with the github login or another method?

[leonardopieralli]

@RadicalMuffinMan All of them: GitHub login, Google login and email/password. Each one ends on the same CSRF page ("Origin checking failed - null does not match any trusted origins"), right after the Cloudflare check. Tried several times today, same result. If it helps, I can try again at a time that suits you while you watch the server logs.

[RadicalMuffinMan]

I checked the server logs for your attempts this morning (11:52 to 11:54 UTC). Every request from your browser arrives with no Referer header, even the stylesheet the page loads, and the sign-up form posts arrive with Origin: null. Other people signed in with GitHub a few minutes before and after you, so Weblate's CSRF settings and the Cloudflare check are working. Browsers only send Origin: null on a form like this when something tells them not to send referrers. Usually that's a privacy extension or a browser setting. Could you try one of these?

Allow referrers for translate.moonfin.io in that extension, or turn it off for the site

Sign up from a private window with extensions disabled, or from another browser

Keep the exception for translate.moonfin.io after you sign up, because saving translations is a form post too and would hit the same error.

[leonardopieralli]

Thanks for checking the logs, that was it: my browser was dropping the referrer. With an exception for translate.moonfin.io sign-up and upload both work. I've uploaded the Italian strings (2084, only into untranslated ones), so Italian is now at 5102 of 5164.