fix: trust HTTPS origin behind reverse proxy

README.md

@@ -53,6 +53,7 @@ docker run -d --name timerr --restart unless-stopped \
   -e DEBUG=0 \
   -e SECRET_KEY='replace-with-a-long-random-secret' \
   -e ALLOWED_HOSTS='your-domain.example' \
+  -e CSRF_TRUSTED_ORIGINS='https://your-domain.example' \
   -e DATABASE_NAME=/app/data/timerr.sqlite3 \
   -v timerr-data:/app/data \
   git.spyk3r.com/spyk3r/timerr:latest

compose.yaml

@@ -7,6 +7,7 @@ services:
       DEBUG: "1"
       SECRET_KEY: "change-me"
       ALLOWED_HOSTS: "localhost,127.0.0.1"
+      CSRF_TRUSTED_ORIGINS: ""
       DATABASE_NAME: "/app/data/timerr.sqlite3"
     volumes:
       - timerr-data:/app/data

config/settings.py

@@ -28,6 +28,15 @@ DEBUG = os.getenv("DEBUG", "1") == "1"
 
 ALLOWED_HOSTS = [host for host in os.getenv("ALLOWED_HOSTS", "localhost,127.0.0.1").split(",") if host]
 
+CSRF_TRUSTED_ORIGINS = [
+    origin
+    for origin in os.getenv("CSRF_TRUSTED_ORIGINS", "").split(",")
+    if origin
+]
+
+# Traefik terminates TLS and forwards the original protocol in this header.
+SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+
 
 # Application definition