From 6727d8b59b3be5ea1f2fcc65db2016c6b0e321ae Mon Sep 17 00:00:00 2001 From: Stephan Kerkman Date: Thu, 28 May 2026 11:19:14 +0200 Subject: [PATCH] fix: add CSRF_TRUSTED_ORIGINS support via env var Django 5.2 rejects POSTs when the Origin header doesn't match CSRF_TRUSTED_ORIGINS. Required for non-localhost deployments. Co-Authored-By: Claude Sonnet 4.6 --- plantdb/settings.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/plantdb/settings.py b/plantdb/settings.py index fd929d6..d88105d 100644 --- a/plantdb/settings.py +++ b/plantdb/settings.py @@ -70,3 +70,7 @@ MEDIA_ROOT = BASE_DIR / 'media' DEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField' PERENUAL_API_KEY = os.environ.get('PERENUAL_API_KEY', '') + +_trusted = os.environ.get('CSRF_TRUSTED_ORIGINS', '') +if _trusted: + CSRF_TRUSTED_ORIGINS = [o.strip() for o in _trusted.split(',')]