westfarn
139f375f73
Unit Tests / test (push) Successful in 11s
## Summary - Closes #18 - Logout POST was failing CSRF Origin checks on HTTPS because `CSRF_TRUSTED_ORIGINS` was unset (Django 5) - Derive trusted origins from `DJANGO_ALLOWED_HOSTS` (override via `DJANGO_CSRF_TRUSTED_ORIGINS`) - Trust reverse-proxy TLS headers in prod/beta (`SECURE_PROXY_SSL_HEADER`, secure cookies) ## Test plan - [x] `python manage.py test public.tests.CsrfTrustedOriginsTests public.tests.LogoutCsrfTests` - [ ] Deploy, log in on aimloperations.com, click Log Out → redirect home, no 403 - [ ] Confirm login still works after deploy Reviewed-on: #19
40 lines
1019 B
Bash
40 lines
1019 B
Bash
# Local development environment file (copy to .env).
|
|
# For production server values, use .env.prod.example instead.
|
|
DJANGO_ENV=dev
|
|
DJANGO_DEBUG=true
|
|
DJANGO_SECRET_KEY=change-me-for-local-development
|
|
DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1,0.0.0.0
|
|
# Optional; when unset, http:// origins are derived for local hosts.
|
|
# DJANGO_CSRF_TRUSTED_ORIGINS=http://localhost:8000,http://127.0.0.1:8000
|
|
|
|
# Database (docker-compose sets DATABASE_URL for the web service)
|
|
DATABASE_URL=postgres://company_site:company_site@db:5432/company_site
|
|
# DB_HOST=db
|
|
# DB_PORT=5432
|
|
# DB_NAME=company_site
|
|
# DB_USER=company_site
|
|
# DB_PASSWORD=company_site
|
|
|
|
# Logging
|
|
# DJANGO_LOG_LEVEL=DEBUG
|
|
|
|
# Analytics
|
|
TIANJI_ENABLED=false
|
|
TIANJI_TRACKER_URL=https://tianji.aimloperations.com/tracker.js
|
|
TIANJI_WEBSITE_ID=
|
|
|
|
# reCAPTCHA
|
|
RECAPTCHA_PUBLIC_KEY=
|
|
RECAPTCHA_PRIVATE_KEY=
|
|
|
|
# Email (SMTP2GO)
|
|
EMAIL_HOST=mail.smtp2go.com
|
|
EMAIL_HOST_USER=
|
|
EMAIL_HOST_PASSWORD=
|
|
EMAIL_PORT=2525
|
|
EMAIL_USE_TLS=true
|
|
|
|
# Gunicorn
|
|
GUNICORN_WORKERS=2
|
|
GUNICORN_BIND=0.0.0.0:8000
|