Ahmadi/com2care_website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): trust deployed CSRF origin

Browse Source 
The live hostname is comp2care.com while the previous configuration only trusted com2care.com. Always include both production domain variants so stale environment overrides cannot block admin login.
This commit is contained in:
mohamad
2026-09-24 09:21:33 +03:30
parent 588d95f889
commit 4bcb5f196d
4 changed files with 29 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+2 -2
View File
@@ -1,8 +1,8 @@
DJANGO_SETTINGS_MODULE=config.settings.production DJANGO_SETTINGS_MODULE=config.settings.production
DJANGO_SECRET_KEY=replace-with-a-long-random-production-secret DJANGO_SECRET_KEY=replace-with-a-long-random-production-secret
DEBUG=False DEBUG=False
ALLOWED_HOSTS=localhost,127.0.0.1,0.0.0.0,com2care.com,www.com2care.com ALLOWED_HOSTS=localhost,127.0.0.1,0.0.0.0,com2care.com,www.com2care.com,comp2care.com,www.comp2care.com
CSRF_TRUSTED_ORIGINS=http://localhost:8000,https://com2care.com,https://www.com2care.com CSRF_TRUSTED_ORIGINS=http://localhost:8000,https://com2care.com,https://www.com2care.com,https://comp2care.com,https://www.comp2care.com
POSTGRES_DB=com2care POSTGRES_DB=com2care
POSTGRES_USER=com2care_user POSTGRES_USER=com2care_user
README.md
+2 -2
View File
@@ -65,8 +65,8 @@ Important variables:
| Variable | Purpose | | Variable | Purpose |
|---|---| |---|---|
| `DJANGO_SECRET_KEY` | Required strong secret for production | | `DJANGO_SECRET_KEY` | Required strong secret for production |
| `ALLOWED_HOSTS` | Hostnames, including `com2care.com` | | `ALLOWED_HOSTS` | Hostnames, including `com2care.com` and `comp2care.com` |
| `CSRF_TRUSTED_ORIGINS` | Full trusted origins with `https://` | | `CSRF_TRUSTED_ORIGINS` | Full trusted origins with `https://`; both production domains are always included |
| `POSTGRES_DB` | PostgreSQL database name | | `POSTGRES_DB` | PostgreSQL database name |
| `POSTGRES_USER` | PostgreSQL user | | `POSTGRES_USER` | PostgreSQL user |
| `POSTGRES_PASSWORD` | PostgreSQL password | | `POSTGRES_PASSWORD` | PostgreSQL password |
config/settings/production.py
+23 -6
View File
@@ -6,7 +6,21 @@ SECRET_KEY = os.environ["DJANGO_SECRET_KEY"]
DEBUG = False DEBUG = False
ALLOWED_HOSTS = os.environ.get("ALLOWED_HOSTS", "").split(",") PRODUCTION_HOSTS = {
"com2care.com",
"www.com2care.com",
"comp2care.com",
"www.comp2care.com",
}
ALLOWED_HOSTS = sorted(
PRODUCTION_HOSTS
| {
host.strip()
for host in os.environ.get("ALLOWED_HOSTS", "").split(",")
if host.strip()
}
)
SECURE_HSTS_SECONDS = 31536000 SECURE_HSTS_SECONDS = 31536000
SECURE_HSTS_INCLUDE_SUBDOMAINS = True SECURE_HSTS_INCLUDE_SUBDOMAINS = True
@@ -18,8 +32,11 @@ SECURE_BROWSER_XSS_FILTER = True
SECURE_CONTENT_TYPE_NOSNIFF = True SECURE_CONTENT_TYPE_NOSNIFF = True
X_FRAME_OPTIONS = "DENY" X_FRAME_OPTIONS = "DENY"
CSRF_TRUSTED_ORIGINS = [ CSRF_TRUSTED_ORIGINS = sorted(
origin.strip() {f"https://{host}" for host in PRODUCTION_HOSTS}
for origin in os.environ.get("CSRF_TRUSTED_ORIGINS", "").split(",") | {
if origin.strip() origin.strip()
] for origin in os.environ.get("CSRF_TRUSTED_ORIGINS", "").split(",")
if origin.strip()
}
)
docker-compose.yml
+2 -2
View File
@@ -22,8 +22,8 @@ services:
environment: environment:
DJANGO_SETTINGS_MODULE: ${DJANGO_SETTINGS_MODULE:-config.settings.production} DJANGO_SETTINGS_MODULE: ${DJANGO_SETTINGS_MODULE:-config.settings.production}
DJANGO_SECRET_KEY: ${DJANGO_SECRET_KEY:-django-insecure-local-com2care-change-in-production} DJANGO_SECRET_KEY: ${DJANGO_SECRET_KEY:-django-insecure-local-com2care-change-in-production}
ALLOWED_HOSTS: ${ALLOWED_HOSTS:-localhost,127.0.0.1,0.0.0.0,com2care.com,www.com2care.com} ALLOWED_HOSTS: ${ALLOWED_HOSTS:-localhost,127.0.0.1,0.0.0.0,com2care.com,www.com2care.com,comp2care.com,www.comp2care.com}
CSRF_TRUSTED_ORIGINS: ${CSRF_TRUSTED_ORIGINS:-http://localhost:8000,https://com2care.com,https://www.com2care.com} CSRF_TRUSTED_ORIGINS: ${CSRF_TRUSTED_ORIGINS:-http://localhost:8000,https://com2care.com,https://www.com2care.com,https://comp2care.com,https://www.comp2care.com}
SECURE_SSL_REDIRECT: ${SECURE_SSL_REDIRECT:-False} SECURE_SSL_REDIRECT: ${SECURE_SSL_REDIRECT:-False}
POSTGRES_DB: ${POSTGRES_DB:-com2care} POSTGRES_DB: ${POSTGRES_DB:-com2care}
POSTGRES_USER: ${POSTGRES_USER:-com2care_user} POSTGRES_USER: ${POSTGRES_USER:-com2care_user}