j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-10-21 10:30:06 +00:00
Code Issues Projects Releases Wiki Activity

fix(security): resolve CSRF 403 on DEBUG=False and improve reverse proxy headers

Browse source 
- Add local ports and env var fallback for CSRF_TRUSTED_ORIGINS in settings.py.template
- Configure SECURE_PROXY_SSL_HEADER for reverse proxy / HTTPS environments
- Update Nginx proxy headers to use $http_host and $scheme to prevent port mismatch
This commit is contained in:
catborise 2026-09-25 10:28:49 +03:00
parent 7a9b3c9e13
commit 933e7b378a
2 changed files with 10 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

7
conf/nginx/webvirtcloud.conf
View file

@ -12,10 +12,9 @@ server {
location / { location / {
proxy_pass http://127.0.0.1:8000; proxy_pass http://127.0.0.1:8000;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-for $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host:$server_port; proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Proto http; proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Ssl off;
proxy_connect_timeout 1800; proxy_connect_timeout 1800;
proxy_read_timeout 1800; proxy_read_timeout 1800;
proxy_send_timeout 1800; proxy_send_timeout 1800;

8
webvirtcloud/settings.py.template
View file

@ -3,6 +3,7 @@ Django settings for webvirtcloud project.
""" """
import os
import subprocess import subprocess
try: try:
import ldap import ldap
@ -24,7 +25,12 @@ MAC_OUI = '52:54:10'
ALLOWED_HOSTS = ["*"] ALLOWED_HOSTS = ["*"]
CSRF_TRUSTED_ORIGINS = ['http://localhost',] CSRF_TRUSTED_ORIGINS = ["http://localhost", "http://127.0.0.1", "http://localhost:8000", "http://127.0.0.1:8000"]
if extra_origins := os.getenv("CSRF_TRUSTED_ORIGINS"):
CSRF_TRUSTED_ORIGINS.extend([origin.strip() for origin in extra_origins.split(",") if origin.strip()])
# Honor X-Forwarded-Proto header for request.is_secure() when behind a reverse proxy (Nginx, Traefik, etc.)
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
# Application definition # Application definition
INSTALLED_APPS = [ INSTALLED_APPS = [