I just upgraded to Django 4 and it includes the ticket 16010 with csrf origin verification changes.
To my knowledge, if you are running an app on localhost, browsers won't send origin (they will send null). So, whenever we run a Django app on localhost, we should expect a header Origin: null in POST requests.
But with the recent change CSRF on localhost can't be validated because of another change - CSRF_TRUSTED_ORIGINS now need to have a scheme. release notes
Is it possible to add a non-empty Origin header when POSTing from localhost?
To be clear, this won't work
from corsheaders.defaults import default_headers
CORS_ALLOW_HEADERS = default_headers + ('Access-Control-Allow-*',)
CORS_ALLOWED_ORIGINS = [
"http://localhost:8000",
"http://127.0.0.1:8000",
]
CSRF_TRUSTED_ORIGINS = [
"http://localhost:8000",
"http://127.0.0.1:8000",
]
<form method="post">
{% csrf_token %}
</form>
Origin checking failed - null does not match any trusted origins.
Request headers
Host: localhost:8000
Origin: null
