Bug 15329

Summary:	Default https://localhost:8081/accounts/login throws a 403 error; CSRF_TRUSTED_ORIGINS needs the port appended
Product:	[Yocto Project Subprojects] Layer Index	Reporter:	Tim Orling <tim.orling>
Component:	Layer Index	Assignee:	Tim Orling <tim.orling>
Status:	NEW ---	QA Contact:	apoorv sangal <apoorvsangal>
Severity:	normal
Priority:	Medium+	CC:	piotr, randy.macleod
Version:	5.0
Target Milestone:	6.1 M2
Hardware:	x86
OS:	Multiple
Whiteboard:
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	Don't know

Description Tim Orling 2023-12-19 20:48:35 UTC

With the introduction of CSRF_TRUSTED_ORIGINS in Django 4.2, a default 'dockersetup.py' installation will set the port to 8081 and the hostname will be localhost.

When logging in, this will result in a 403 error:
Origin checking failed - https://localhost:8081 does not match any trusted origins.

In order for this combination to work, 
CSRF_TRUSTED_ORIGINS = ['https://' + os.getenv('HOSTNAME', 'layers.test'), 'https://localhost:8081']
would have to be the setting.

The fix should be in making the dockersetup.py script smart enough to append the port conditionally if it is not the default 80 or 443.

Comment 1 Randy MacLeod 2025-02-13 16:05:16 UTC

Michael, is this something you can do on the systems that run the layer index?

Comment 2 Michael Halstead 2025-02-13 18:49:23 UTC

As far as I understand this issue is not a problem for production deployments including the main one at layers.openembedded.org. I can have a look next time I set up a test instance but I hope a developer beats me to it.

Comment 3 Tim Orling 2026-02-26 16:09:38 UTC

We're likely moving away from the dockersetup.py script to .env files and docker-compose. I think the .devcontainer work by Piotr completely avoids this particular problem?

Comment 4 Piotr Buliński 2026-03-06 18:22:22 UTC

This does not seem to be a problem with the current Dev Container setup and shouldn't be a problem if deployed using docker/settings.py, as this property is derived from HOSTNAME env variable (with backwards compatible default).

When using default, out-of-the-box setup for Dev Container, log in works without any issues.