Ahmadi/com2care_website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): trust deployed CSRF origin

Browse Source 
The live hostname is comp2care.com while the previous configuration only trusted com2care.com. Always include both production domain variants so stale environment overrides cannot block admin login.
This commit is contained in:
mohamad
2026-09-24 09:21:33 +03:30
parent 588d95f889
commit 4bcb5f196d
4 changed files with 29 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+2 -2
View File
@@ -1,8 +1,8 @@
DJANGO_SETTINGS_MODULE=config.settings.production
DJANGO_SECRET_KEY=replace-with-a-long-random-production-secret
DEBUG=False
ALLOWED_HOSTS=localhost,127.0.0.1,0.0.0.0,com2care.com,www.com2care.com
CSRF_TRUSTED_ORIGINS=http://localhost:8000,https://com2care.com,https://www.com2care.com
ALLOWED_HOSTS=localhost,127.0.0.1,0.0.0.0,com2care.com,www.com2care.com,comp2care.com,www.comp2care.com
CSRF_TRUSTED_ORIGINS=http://localhost:8000,https://com2care.com,https://www.com2care.com,https://comp2care.com,https://www.comp2care.com
POSTGRES_DB=com2care
POSTGRES_USER=com2care_user
README.md
+2 -2
View File
@@ -65,8 +65,8 @@ Important variables:
| Variable | Purpose |
|---|---|
| `DJANGO_SECRET_KEY` | Required strong secret for production |
| `ALLOWED_HOSTS` | Hostnames, including `com2care.com` |
| `CSRF_TRUSTED_ORIGINS` | Full trusted origins with `https://` |
| `ALLOWED_HOSTS` | Hostnames, including `com2care.com` and `comp2care.com` |
| `CSRF_TRUSTED_ORIGINS` | Full trusted origins with `https://`; both production domains are always included |
| `POSTGRES_DB` | PostgreSQL database name |
| `POSTGRES_USER` | PostgreSQL user |
| `POSTGRES_PASSWORD` | PostgreSQL password |
config/settings/production.py
+23 -6
View File
@@ -6,7 +6,21 @@ SECRET_KEY = os.environ["DJANGO_SECRET_KEY"]
DEBUG = False
ALLOWED_HOSTS = os.environ.get("ALLOWED_HOSTS", "").split(",")
PRODUCTION_HOSTS = {
"com2care.com",
"www.com2care.com",
"comp2care.com",
"www.comp2care.com",
}
ALLOWED_HOSTS = sorted(
PRODUCTION_HOSTS
| {
host.strip()
for host in os.environ.get("ALLOWED_HOSTS", "").split(",")
if host.strip()
}
)
SECURE_HSTS_SECONDS = 31536000
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
@@ -18,8 +32,11 @@ SECURE_BROWSER_XSS_FILTER = True
SECURE_CONTENT_TYPE_NOSNIFF = True
X_FRAME_OPTIONS = "DENY"
CSRF_TRUSTED_ORIGINS = [
origin.strip()
for origin in os.environ.get("CSRF_TRUSTED_ORIGINS", "").split(",")
if origin.strip()
]
CSRF_TRUSTED_ORIGINS = sorted(
{f"https://{host}" for host in PRODUCTION_HOSTS}
| {
origin.strip()
for origin in os.environ.get("CSRF_TRUSTED_ORIGINS", "").split(",")
if origin.strip()
}
)
docker-compose.yml
+2 -2
View File
@@ -22,8 +22,8 @@ services:
environment:
DJANGO_SETTINGS_MODULE: ${DJANGO_SETTINGS_MODULE:-config.settings.production}
DJANGO_SECRET_KEY: ${DJANGO_SECRET_KEY:-django-insecure-local-com2care-change-in-production}
ALLOWED_HOSTS: ${ALLOWED_HOSTS:-localhost,127.0.0.1,0.0.0.0,com2care.com,www.com2care.com}
CSRF_TRUSTED_ORIGINS: ${CSRF_TRUSTED_ORIGINS:-http://localhost:8000,https://com2care.com,https://www.com2care.com}
ALLOWED_HOSTS: ${ALLOWED_HOSTS:-localhost,127.0.0.1,0.0.0.0,com2care.com,www.com2care.com,comp2care.com,www.comp2care.com}
CSRF_TRUSTED_ORIGINS: ${CSRF_TRUSTED_ORIGINS:-http://localhost:8000,https://com2care.com,https://www.com2care.com,https://comp2care.com,https://www.comp2care.com}
SECURE_SSL_REDIRECT: ${SECURE_SSL_REDIRECT:-False}
POSTGRES_DB: ${POSTGRES_DB:-com2care}
POSTGRES_USER: ${POSTGRES_USER:-com2care_user}