dunkelstern/inventory
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

Experimental: set CSRF trusted origins

Browse source
This commit is contained in:
Johannes Schriewer 2025-01-19 18:29:12 +01:00
parent 0c1fce561a
commit d324a1853b
3 changed files with 15 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
Readme.md
View file

@ -88,6 +88,7 @@ next steps below
INVENTORY_SECRET_KEY= INVENTORY_SECRET_KEY=
INVENTORY_EXTERNAL_URL=http://localhost:8000 INVENTORY_EXTERNAL_URL=http://localhost:8000
INVENTORY_TRUSTED_ORIGINS=localhost:8000
INVENTORY_DEBUG=FALSE INVENTORY_DEBUG=FALSE
INVENTORY_LANGUAGE=en-us INVENTORY_LANGUAGE=en-us

5
default.env
View file

@ -4,6 +4,11 @@ INVENTORY_SECRET_KEY=""
# override with URL the service will be available under # override with URL the service will be available under
INVENTORY_EXTERNAL_URL="https://inventory.example.com" INVENTORY_EXTERNAL_URL="https://inventory.example.com"
# override with URLs that are used to send POST requests here,
# the EXTERNAL_URL will be in there already, http and https
# will be added automatically, separate multiple origins with commas
INVENTORY_TRUSTED_ORIGINS="localhost"
# keep this to FALSE for deployments # keep this to FALSE for deployments
INVENTORY_DEBUG="FALSE" INVENTORY_DEBUG="FALSE"

9
inventory_project/settings.py
View file

@ -45,6 +45,15 @@ ALLOWED_HOSTS: list[str] = [
socket.gethostbyname('localhost') socket.gethostbyname('localhost')
] ]
CSRF_TRUSTED_ORIGINS: list[str] = [
*[
f'{prot}://{host}'
for host in os.environ.get("INVENTORY_TRUSTED_ORIGINS", "localhost").split(',')
for prot in ('http', 'https')
],
f'{SERVER_URL}}'
]
# Application definition # Application definition
INSTALLED_APPS = [ INSTALLED_APPS = [