openedx / openedx/openedx-platform
[Django 4.2] Django>=4.0 must include both scheme and host in CSRF_TRUSTED_ORIGINS
Open
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.2k
- Forks
- 4.4k
- Avg merge
- 6d 18h
- Merged PRs (30d)
- 42
Description
Django 4.0 and above
- For Django 4.0 and above, CSRF_TRUSTED_ORIGINS must include scheme and host, e.g.:
https://dummy.example.com
Django 3.2 and lower
- For Django 3.2 and lower, CSRF_TRUSTED_ORIGINS must contain only the hostname, without a scheme:
.example.com
Reference release notes documentation
- https://docs.djangoproject.com/en/3.2/ref/settings/#csrf-trusted-origins
- https://docs.djangoproject.com/en/4.0/ref/settings/#csrf-trusted-origins
Further details on this change can be read in https://forum.djangoproject.com/t/django-4-0-wildcard-subdomain-preventing-from-setting-csrf-token/11599/28.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test is named in the issue. Start by locating CSRF_TRUSTED_ORIGINS configuration and usages in openedx-platform, then compare them with the linked Django 3.2 and 4.0 setting documentation. Done means the relevant configuration supports the required scheme-and-host format for Django 4.2 without breaking the older supported behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- django, python
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100