Ahmadi/com2care_website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): trust deployed CSRF origin

Browse Source 
The live hostname is comp2care.com while the previous configuration only trusted com2care.com. Always include both production domain variants so stale environment overrides cannot block admin login.
This commit is contained in:
mohamad
2026-09-24 09:21:33 +03:30
parent 588d95f889
commit 4bcb5f196d
4 changed files with 29 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+2 -2
View File
@@ -1,8 +1,8 @@
DJANGO_SETTINGS_MODULE=config.settings.production
DJANGO_SECRET_KEY=replace-with-a-long-random-production-secret
DEBUG=False
ALLOWED_HOSTS=localhost,127.0.0.1,0.0.0.0,com2care.com,www.com2care.com
CSRF_TRUSTED_ORIGINS=http://localhost:8000,https://com2care.com,https://www.com2care.com
ALLOWED_HOSTS=localhost,127.0.0.1,0.0.0.0,com2care.com,www.com2care.com,comp2care.com,www.comp2care.com
CSRF_TRUSTED_ORIGINS=http://localhost:8000,https://com2care.com,https://www.com2care.com,https://comp2care.com,https://www.comp2care.com
POSTGRES_DB=com2care
POSTGRES_USER=com2care_user