ai_ml_operations/company_site
2
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Fix logout 403 CSRF verification failed (#18) #19

Merged
westfarn merged 1 commits from fix/18-logout-csrf-403 into master 2026-07-10 17:39:29 -07:00
Conversation 0 Commits 1 Files Changed 6
+94
westfarn commented 2026-07-10 11:12:23 -07:00
Owner
Copy Link
Copy Source

Summary

  • Closes Logout returns 403 CSRF verification failed (#18)
  • Logout POST was failing CSRF Origin checks on HTTPS because CSRF_TRUSTED_ORIGINS was unset (Django 5)
  • Derive trusted origins from DJANGO_ALLOWED_HOSTS (override via DJANGO_CSRF_TRUSTED_ORIGINS)
  • Trust reverse-proxy TLS headers in prod/beta (SECURE_PROXY_SSL_HEADER, secure cookies)

Test plan

  • python manage.py test public.tests.CsrfTrustedOriginsTests public.tests.LogoutCsrfTests
  • Deploy, log in on aimloperations.com, click Log Out → redirect home, no 403
  • Confirm login still works after deploy
## Summary - Closes #18 - Logout POST was failing CSRF Origin checks on HTTPS because `CSRF_TRUSTED_ORIGINS` was unset (Django 5) - Derive trusted origins from `DJANGO_ALLOWED_HOSTS` (override via `DJANGO_CSRF_TRUSTED_ORIGINS`) - Trust reverse-proxy TLS headers in prod/beta (`SECURE_PROXY_SSL_HEADER`, secure cookies) ## Test plan - [x] `python manage.py test public.tests.CsrfTrustedOriginsTests public.tests.LogoutCsrfTests` - [ ] Deploy, log in on aimloperations.com, click Log Out → redirect home, no 403 - [ ] Confirm login still works after deploy
westfarn added 1 commit 2026-07-10 11:12:23 -07:00
Fix logout 403 by setting CSRF trusted origins (#18)
CI / test (pull_request) Successful in 11s
Details
Unit Tests / test (pull_request) Successful in 10s
Details
eed8852897 
Django 5 rejects HTTPS POSTs without CSRF_TRUSTED_ORIGINS; derive them from ALLOWED_HOSTS and trust the reverse-proxy TLS headers in prod/beta.
westfarn merged commit 139f375f73 into master 2026-07-10 17:39:29 -07:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
twestfall westfarn (Ryan Westfall)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: ai_ml_operations/company_site#19