From 7f106bbf5c9452c3cbf5a6e249ce64342fbf8886 Mon Sep 17 00:00:00 2001 From: PouyaKhajavi Date: Mon, 10 Aug 2026 11:29:33 +0330 Subject: [PATCH] fix(settings): add SECURE_PROXY_SSL_HEADER and USE_X_FORWARDED_HOST for reverse proxy HTTPS support --- backend/config/settings.py | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/backend/config/settings.py b/backend/config/settings.py index c642958..03bf138 100644 --- a/backend/config/settings.py +++ b/backend/config/settings.py @@ -40,13 +40,23 @@ if IS_DEV: ] else: DEBUG = os.getenv('DJANGO_DEBUG', 'False').lower() in ('true', '1', 't') - ALLOWED_HOSTS = [host.strip() for host in os.getenv('ALLOWED_HOSTS', '*').split(',') if host.strip()] + allowed_hosts_raw = os.getenv('ALLOWED_HOSTS', '*') + ALLOWED_HOSTS = [host.strip() for host in allowed_hosts_raw.split(',') if host.strip()] + if '*' not in ALLOWED_HOSTS: + ALLOWED_HOSTS.extend(['localhost', '127.0.0.1', 'backend', 'divar_backend']) + CORS_ALLOW_ALL_ORIGINS = os.getenv('CORS_ALLOW_ALL_ORIGINS', 'False').lower() in ('true', '1', 't') if not CORS_ALLOW_ALL_ORIGINS: CORS_ALLOWED_ORIGINS = [origin.strip() for origin in os.getenv('CORS_ALLOWED_ORIGINS', '').split(',') if origin.strip()] + csrf_origins = os.getenv('CSRF_TRUSTED_ORIGINS', 'http://localhost,http://127.0.0.1') CSRF_TRUSTED_ORIGINS = [origin.strip() for origin in csrf_origins.split(',') if origin.strip()] +# Reverse Proxy SSL / Host headers configuration (for Nginx / Docker reverse proxies) +SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https') +USE_X_FORWARDED_HOST = True +USE_X_FORWARDED_PORT = True + # Application definition