0

settings.py

INSTALLED_APPS = [
    ...
    'corsheaders',
]


MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'corsheaders.middleware.CorsMiddleware',
    'django.middleware.common.CommonMiddleware',
    ...
]


ALLOWED_HOSTS = ['*']
CORS_ORIGIN_ALLOW_ALL = True

ajax request

            $.ajax({
                type: "POST",
                url: `https://example.com/requestlink/`,
                crossDomain: true,
                data: {
                    link: link,
                    csrfmiddlewaretoken: csrf,
                },

                success: function (data) {
                    if (data) {
                        data.forEach(src => {
                            createresult(src);
                        })
                    }
                    icon.classList.replace('loading', 'search');
                },
                error: function (data) {
                    icon.classList.replace('loading', 'search');
                }
            })

Now when i do ajax post request, I got this in console tab

Status 403 Forbidden
Version HTTP/1.1
Transferred 1.53 KB (2.50 KB size)
Referrer Policy no-referrer-when-downgrade

and this in backend

Forbidden (Referer checking failed - https:// anotherexample.com / does not match any trusted origins.): /requestlink/

Why so?

sideshowbarker
  • 81,827
  • 26
  • 193
  • 197
RoyalBosS
  • 350
  • 3
  • 13
  • `Referer` checking is not part of CORS. This isn't a CORS issue, but some other authorization issue. Check whatever the backend does to validate the `Referer` header. – jub0bs Oct 08 '21 at 09:37
  • What should i do? – RoyalBosS Oct 08 '21 at 09:44
  • => *Check whatever the backend does to validate the `Referer` header.* – jub0bs Oct 08 '21 at 09:58
  • how and in which file? – RoyalBosS Oct 08 '21 at 10:47
  • You must be using `django.middleware.csrf`, correct? From reading the source code, that middleware rejects the request if the host of the `Referer` header is different from the target origin's. You can deactivate that protection, if needed; see https://stackoverflow.com/questions/16458166/how-to-disable-djangos-csrf-validation – jub0bs Oct 08 '21 at 10:58

0 Answers0