From d2358fb0bb5853e45b3577699c9c009e0bd32153 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 26 Jul 2025 23:24:38 +0530 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20Fix=20CSRF=20verification=20fail?= =?UTF-8?q?ed=20error=20for=20Railway=20domain?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add quantum-ai.up.railway.app to CSRF_TRUSTED_ORIGINS - Include development origins (localhost, 127.0.0.1) - Improve Railway domain detection with fallback - Prevent duplicate domain entries Fixes 403 CSRF verification failed errors on login and admin forms. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude --- netcop_hub/settings.py | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/netcop_hub/settings.py b/netcop_hub/settings.py index d63683f..d7e2522 100644 --- a/netcop_hub/settings.py +++ b/netcop_hub/settings.py @@ -296,11 +296,24 @@ EMAIL_TIMEOUT = 30 # Security settings CSRF_TRUSTED_ORIGINS = [origin.strip() for origin in config('CSRF_TRUSTED_ORIGINS', default='').split(',') if origin.strip()] +# Always include common development origins +CSRF_TRUSTED_ORIGINS.extend([ + 'http://localhost:8000', + 'http://127.0.0.1:8000', + 'https://localhost:8000', + 'https://127.0.0.1:8000' +]) + # Add Railway domain if running on Railway if config('RAILWAY_ENVIRONMENT', default=''): + # Add known Railway domain + CSRF_TRUSTED_ORIGINS.append('https://quantum-ai.up.railway.app') + + # Try to get Railway public domain from environment railway_url = config('RAILWAY_PUBLIC_DOMAIN', default='') - if railway_url: + if railway_url and f'https://{railway_url}' not in CSRF_TRUSTED_ORIGINS: CSRF_TRUSTED_ORIGINS.append(f'https://{railway_url}') + # Also add production domain CSRF_TRUSTED_ORIGINS.append('https://quantumtaskai.com')