Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Django CSRF protection behind proxy automatically #366

Open
undergroundwires opened this issue Jan 19, 2024 · 0 comments
Open

Fix Django CSRF protection behind proxy automatically #366

undergroundwires opened this issue Jan 19, 2024 · 0 comments

Comments

@undergroundwires
Copy link

undergroundwires commented Jan 19, 2024

After migrating Seafile 11 running Django 4.0, users using proxies start getting Origin checking failed - XX does not match any trusted origins. errors.

Handling this is documented in Server FAQ.

Setting CSRF_TRUSTED_ORIGINS = ["{url}"] in {data_dir}/seafile/conf/seahub_settings.py solves the issue.

It would be nice that the docker instance configures this automatically for a seamless experience so not everyone spends hours on debugging this like me.

It would be nice to introduce a variable like PROXY_ROOT_URL or PROXY_BASE_URL_WITH_SCHEME. So in this code it can set CSRF_TRUSTED_ORIGINS = ["{PROXY_ROOT_URL}"] (if PROXY_ROOT_URL is defined) to the URL. Or just use {proto}://{domain} utilizing FORCE_HTTPS_IN_CONF without introducing any new configuration.

Solves #347, and a lot of other StackOverflow, forum GitHub issues.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant