From a4ff78f13a341ebf3b09455299c1a8fc6d74d4a1 Mon Sep 17 00:00:00 2001 From: PouyaKhajavi Date: Mon, 10 Aug 2026 11:34:37 +0330 Subject: [PATCH] fix(nginx): pass X-Forwarded-Proto and host headers cleanly and allow wildcard host in production --- backend/config/settings.py | 12 +++++------- frontend/nginx.conf | 12 ++++++------ 2 files changed, 11 insertions(+), 13 deletions(-) diff --git a/backend/config/settings.py b/backend/config/settings.py index 03bf138..045444f 100644 --- a/backend/config/settings.py +++ b/backend/config/settings.py @@ -36,20 +36,18 @@ if IS_DEV: ALLOWED_HOSTS = ['*'] CORS_ALLOW_ALL_ORIGINS = True CSRF_TRUSTED_ORIGINS = [ - 'http://localhost:5173', 'http://localhost:8000', 'http://127.0.0.1:8000', 'http://localhost', 'http://127.0.0.1' + 'http://localhost:5173', 'http://localhost:8000', 'http://127.0.0.1:8000', 'http://localhost', 'http://127.0.0.1', + 'https://divar.nwhco.ir', 'http://divar.nwhco.ir' ] else: DEBUG = os.getenv('DJANGO_DEBUG', 'False').lower() in ('true', '1', 't') allowed_hosts_raw = os.getenv('ALLOWED_HOSTS', '*') ALLOWED_HOSTS = [host.strip() for host in allowed_hosts_raw.split(',') if host.strip()] if '*' not in ALLOWED_HOSTS: - ALLOWED_HOSTS.extend(['localhost', '127.0.0.1', 'backend', 'divar_backend']) + ALLOWED_HOSTS.append('*') - CORS_ALLOW_ALL_ORIGINS = os.getenv('CORS_ALLOW_ALL_ORIGINS', 'False').lower() in ('true', '1', 't') - if not CORS_ALLOW_ALL_ORIGINS: - CORS_ALLOWED_ORIGINS = [origin.strip() for origin in os.getenv('CORS_ALLOWED_ORIGINS', '').split(',') if origin.strip()] - - csrf_origins = os.getenv('CSRF_TRUSTED_ORIGINS', 'http://localhost,http://127.0.0.1') + CORS_ALLOW_ALL_ORIGINS = True + csrf_origins = os.getenv('CSRF_TRUSTED_ORIGINS', 'https://divar.nwhco.ir,http://divar.nwhco.ir,http://localhost,http://127.0.0.1') CSRF_TRUSTED_ORIGINS = [origin.strip() for origin in csrf_origins.split(',') if origin.strip()] # Reverse Proxy SSL / Host headers configuration (for Nginx / Docker reverse proxies) diff --git a/frontend/nginx.conf b/frontend/nginx.conf index 708b711..d617d88 100644 --- a/frontend/nginx.conf +++ b/frontend/nginx.conf @@ -17,27 +17,27 @@ server { # Proxy Django API requests location /api/ { proxy_pass http://backend:8000; - proxy_set_header Host $host; + proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; } # Proxy Django Admin interface location /admin/ { proxy_pass http://backend:8000; - proxy_set_header Host $host; + proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; } # Proxy Django static files (admin assets, etc.) location /static/ { proxy_pass http://backend:8000; - proxy_set_header Host $host; + proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; } }