Record the canonical public hostname, any separate frontend origin and the trusted proxy chain. Reproduce the failing request without disabling security middleware.

1. Set ALLOWED_HOSTS to the hostnames the application is intended to serve. Avoid a wildcard merely to silence an invalid-host error.

2. For legitimate cross-origin browser submissions, configure the exact required CSRF_TRUSTED_ORIGINS values, including their schemes. This is separate from allowing a hostname.

3. Ensure templates and JavaScript submit CSRF tokens through the supported Django mechanism. Check cookie domain, path and HTTPS-only settings.

4. Configure proxy SSL recognition only when the proxy reliably strips or overwrites the relevant incoming header. The application must not trust a header supplied directly by arbitrary clients.

5. Restart the application with the corrected settings and test a new browser session through the public HTTPS address.

For a Django service at https://api.example.com receiving approved browser form requests from https://www.example.com, the host and CSRF origin lists answer different questions. Merge these example values into the appropriate production settings after confirming the real addresses.

ALLOWED_HOSTS = ['api.example.com']
CSRF_TRUSTED_ORIGINS = ['https://www.example.com']
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True

The host list does not include a scheme, while the trusted origin does. Keep CSRF token handling in the frontend and preserve the application’s authentication. A separate API CORS policy may also be needed. Add proxy SSL recognition only when the trusted proxy overwrites the relevant header and the upstream listener is protected.

Expected result: A permitted submission succeeds over HTTPS, an unexpected Host is rejected, and a missing CSRF token still fails. Broad wildcard lists are not required to make the documented customer workflow function.

Test a login and a state-changing form. Confirm an unexpected Host header is rejected and that the proxy does not generate HTTP links for an HTTPS request.

A CSRF failure after login may involve stale cookies, a missing token or an origin mismatch. Use the private rejection reason to choose the fix rather than adding increasingly broad trusted origins.

• Setting Django production settings and secret keys
• Troubleshooting browser CORS errors for an API
• Preparing and deploying a Django application on eligible hosting
• Choosing WSGI or ASGI for Django hosting

• Django settings
• Django CSRF protection

• Django settings reference