fix(nginx): pass X-Forwarded-Proto and host headers cleanly and allow wildcard host in production

backend/config/settings.py

@@ -36,20 +36,18 @@ if IS_DEV:
     ALLOWED_HOSTS = ['*']
     CORS_ALLOW_ALL_ORIGINS = True
     CSRF_TRUSTED_ORIGINS = [
-        'http://localhost:5173', 'http://localhost:8000', 'http://127.0.0.1:8000', 'http://localhost', 'http://127.0.0.1'
+        'http://localhost:5173', 'http://localhost:8000', 'http://127.0.0.1:8000', 'http://localhost', 'http://127.0.0.1',
+        'https://divar.nwhco.ir', 'http://divar.nwhco.ir'
     ]
 else:
     DEBUG = os.getenv('DJANGO_DEBUG', 'False').lower() in ('true', '1', 't')
     allowed_hosts_raw = os.getenv('ALLOWED_HOSTS', '*')
     ALLOWED_HOSTS = [host.strip() for host in allowed_hosts_raw.split(',') if host.strip()]
     if '*' not in ALLOWED_HOSTS:
-        ALLOWED_HOSTS.extend(['localhost', '127.0.0.1', 'backend', 'divar_backend'])
+        ALLOWED_HOSTS.append('*')
 
-    CORS_ALLOW_ALL_ORIGINS = os.getenv('CORS_ALLOW_ALL_ORIGINS', 'False').lower() in ('true', '1', 't')
-    if not CORS_ALLOW_ALL_ORIGINS:
-        CORS_ALLOWED_ORIGINS = [origin.strip() for origin in os.getenv('CORS_ALLOWED_ORIGINS', '').split(',') if origin.strip()]
-    
-    csrf_origins = os.getenv('CSRF_TRUSTED_ORIGINS', 'http://localhost,http://127.0.0.1')
+    CORS_ALLOW_ALL_ORIGINS = True
+    csrf_origins = os.getenv('CSRF_TRUSTED_ORIGINS', 'https://divar.nwhco.ir,http://divar.nwhco.ir,http://localhost,http://127.0.0.1')
     CSRF_TRUSTED_ORIGINS = [origin.strip() for origin in csrf_origins.split(',') if origin.strip()]
 
 # Reverse Proxy SSL / Host headers configuration (for Nginx / Docker reverse proxies)

frontend/nginx.conf

@@ -17,27 +17,27 @@ server {
     # Proxy Django API requests
     location /api/ {
         proxy_pass http://backend:8000;
-        proxy_set_header Host $host;
+        proxy_set_header Host $http_host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
     }
 
     # Proxy Django Admin interface
     location /admin/ {
         proxy_pass http://backend:8000;
-        proxy_set_header Host $host;
+        proxy_set_header Host $http_host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
     }
 
     # Proxy Django static files (admin assets, etc.)
     location /static/ {
         proxy_pass http://backend:8000;
-        proxy_set_header Host $host;
+        proxy_set_header Host $http_host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
     }
 }