With the introduction of CSRF_TRUSTED_ORIGINS in Django 4.2, a default 'dockersetup.py' installation will set the port to 8081 and the hostname will be localhost. When logging in, this will result in a 403 error: Origin checking failed - https://localhost:8081 does not match any trusted origins. In order for this combination to work, CSRF_TRUSTED_ORIGINS = ['https://' + os.getenv('HOSTNAME', 'layers.test'), 'https://localhost:8081'] would have to be the setting. The fix should be in making the dockersetup.py script smart enough to append the port conditionally if it is not the default 80 or 443.
Michael, is this something you can do on the systems that run the layer index?
As far as I understand this issue is not a problem for production deployments including the main one at layers.openembedded.org. I can have a look next time I set up a test instance but I hope a developer beats me to it.
We're likely moving away from the dockersetup.py script to .env files and docker-compose. I think the .devcontainer work by Piotr completely avoids this particular problem?
This does not seem to be a problem with the current Dev Container setup and shouldn't be a problem if deployed using docker/settings.py, as this property is derived from HOSTNAME env variable (with backwards compatible default). When using default, out-of-the-box setup for Dev Container, log in works without any issues.