fix: SB-814 Missing CSRF_TRUSTED_ORIGINS

* fix: SB-814 Set CSRF_TRUSTED_ORIGINS Approved-by: Michał Kleszcz
apptension · Feb 15, 2023 · e192816 · e192816
1 parent 9862584
commit e192816
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/packages/backend/config/settings.py b/packages/backend/config/settings.py
@@ -287,3 +287,5 @@
     'AWS_XRAY_CONTEXT_MISSING': 'IGNORE_ERROR',
     'PLUGINS': ('ECSPlugin',),
 }
+
+CSRF_TRUSTED_ORIGINS = env("CSRF_TRUSTED_ORIGINS", default=[])
diff --git a/packages/backend/infra/stacks/api/stack.ts b/packages/backend/infra/stacks/api/stack.ts
@@ -65,6 +65,8 @@ export class ApiStack extends Stack {
       envSettings.domains.www,
     ].join(',');
 
+    const csrfTrustedOrigins = [`https://${envSettings.domains.adminPanel}`].join(',');
+
     const httpsListener =
       elb2.ApplicationListener.fromApplicationListenerAttributes(
         this,
@@ -106,6 +108,7 @@ export class ApiStack extends Stack {
               CHAMBER_SERVICE_NAME: this.getChamberServiceName(envSettings),
               CHAMBER_KMS_KEY_ALIAS: MainKmsKey.getKeyAlias(envSettings),
               DJANGO_ALLOWED_HOSTS: allowedHosts,
+              CSRF_TRUSTED_ORIGINS: csrfTrustedOrigins,
               WORKERS_EVENT_BUS_NAME: EnvComponentsStack.getWorkersEventBusName(
                 props.envSettings
               ),