ATTUNE-HEART-THERAPY/alternative-backend-service
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

config: add CSRF trusted origins for production domains

Browse Source 
Add CSRF_TRUSTED_ORIGINS setting to whitelist the production domains
(attunehearttherapy.com and its api subdomain) for CSRF verification.
This ensures secure cross-origin POST requests from the frontend.

Also add documentation comment for CORS configuration section.
This commit is contained in:
saani 2025-11-25 18:27:57 +00:00
parent 4b75d38713
commit 4f07d854e1
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
booking_system/settings.py
View File

@ -14,6 +14,7 @@ DEBUG = os.getenv('DEBUG', 'False').lower() == 'true'
ALLOWED_HOSTS = os.getenv('ALLOWED_HOSTS', '*').split(',') ALLOWED_HOSTS = os.getenv('ALLOWED_HOSTS', '*').split(',')
# CORS Configuration
CORS_ALLOWED_ORIGINS = [ CORS_ALLOWED_ORIGINS = [
'http://localhost:3000', 'http://localhost:3000',
'http://127.0.0.1:3000', 'http://127.0.0.1:3000',
@ -22,6 +23,10 @@ CORS_ALLOWED_ORIGINS = [
CORS_ALLOW_CREDENTIALS = True CORS_ALLOW_CREDENTIALS = True
CSRF_TRUSTED_ORIGINS = [
'https://api.attunehearttherapy.com',
'https://attunehearttherapy.com'
]
INSTALLED_APPS = [ INSTALLED_APPS = [
'jazzmin', 'jazzmin',