From b17e61c1b8712ab6dae38bf7755f0e5af2886999 Mon Sep 17 00:00:00 2001 From: Alam-2U Date: Wed, 13 Aug 2025 06:41:57 +0000 Subject: [PATCH 1/2] chore: remove CSRF_TRUSTED_ORIGINS_WITH_SCHEME variable --- cms/envs/mock.yml | 2 -- cms/envs/production.py | 2 +- lms/envs/mock.yml | 2 -- lms/envs/production.py | 2 +- 4 files changed, 2 insertions(+), 6 deletions(-) diff --git a/cms/envs/mock.yml b/cms/envs/mock.yml index c3d0ccd1cb59..8ab3beea07f3 100644 --- a/cms/envs/mock.yml +++ b/cms/envs/mock.yml @@ -247,8 +247,6 @@ CROSS_DOMAIN_CSRF_COOKIE_NAME: csrftoken CSRF_COOKIE_SECURE: true CSRF_TRUSTED_ORIGINS: - https://*.localhost -CSRF_TRUSTED_ORIGINS_WITH_SCHEME: -- https://*.localhost DATABASES: blockstore: CONN_MAX_AGE: 600 diff --git a/cms/envs/production.py b/cms/envs/production.py index 12c7daed66e6..b269ca8664dd 100644 --- a/cms/envs/production.py +++ b/cms/envs/production.py @@ -155,7 +155,7 @@ def get_env_setting(setting): # Once we have migrated to service assets off S3, then we can convert this back to # managed by the yaml file contents STATICFILES_STORAGE = os.environ.get('STATICFILES_STORAGE', STATICFILES_STORAGE) -CSRF_TRUSTED_ORIGINS = _YAML_TOKENS.get('CSRF_TRUSTED_ORIGINS_WITH_SCHEME', []) +CSRF_TRUSTED_ORIGINS = _YAML_TOKENS.get('CSRF_TRUSTED_ORIGINS', []) MKTG_URL_LINK_MAP.update(_YAML_TOKENS.get('MKTG_URL_LINK_MAP', {})) diff --git a/lms/envs/mock.yml b/lms/envs/mock.yml index ad6ccb64c7c1..10ec3d1e265e 100644 --- a/lms/envs/mock.yml +++ b/lms/envs/mock.yml @@ -330,8 +330,6 @@ CROSS_DOMAIN_CSRF_COOKIE_NAME: '' CSRF_COOKIE_SECURE: true CSRF_TRUSTED_ORIGINS: - https://*.sandbox.localhost -CSRF_TRUSTED_ORIGINS_WITH_SCHEME: -- https://*.sandbox.localhost DASHBOARD_COURSE_LIMIT: 250 DATABASES: blockstore: diff --git a/lms/envs/production.py b/lms/envs/production.py index 835abc0dcfbd..b9196fc9104d 100644 --- a/lms/envs/production.py +++ b/lms/envs/production.py @@ -197,7 +197,7 @@ def get_env_setting(setting): service_variant=SERVICE_VARIANT, ) -CSRF_TRUSTED_ORIGINS = _YAML_TOKENS.get('CSRF_TRUSTED_ORIGINS_WITH_SCHEME', []) +CSRF_TRUSTED_ORIGINS = _YAML_TOKENS.get('CSRF_TRUSTED_ORIGINS', []) if FEATURES['ENABLE_CORS_HEADERS'] or FEATURES.get('ENABLE_CROSS_DOMAIN_CSRF_COOKIE'): CORS_ALLOW_CREDENTIALS = True From e85c9bb5a1b567fc6e763edc655e706e218e9734 Mon Sep 17 00:00:00 2001 From: Alam-2U Date: Mon, 18 Aug 2025 06:07:49 +0000 Subject: [PATCH 2/2] chore: remove CSRF_TRUSTED_ORIGINS_WITH_SCHEME variable --- cms/envs/production.py | 1 - lms/envs/production.py | 2 -- 2 files changed, 3 deletions(-) diff --git a/cms/envs/production.py b/cms/envs/production.py index b269ca8664dd..7bc4677d80c0 100644 --- a/cms/envs/production.py +++ b/cms/envs/production.py @@ -155,7 +155,6 @@ def get_env_setting(setting): # Once we have migrated to service assets off S3, then we can convert this back to # managed by the yaml file contents STATICFILES_STORAGE = os.environ.get('STATICFILES_STORAGE', STATICFILES_STORAGE) -CSRF_TRUSTED_ORIGINS = _YAML_TOKENS.get('CSRF_TRUSTED_ORIGINS', []) MKTG_URL_LINK_MAP.update(_YAML_TOKENS.get('MKTG_URL_LINK_MAP', {})) diff --git a/lms/envs/production.py b/lms/envs/production.py index b9196fc9104d..6b91bfee36b2 100644 --- a/lms/envs/production.py +++ b/lms/envs/production.py @@ -197,8 +197,6 @@ def get_env_setting(setting): service_variant=SERVICE_VARIANT, ) -CSRF_TRUSTED_ORIGINS = _YAML_TOKENS.get('CSRF_TRUSTED_ORIGINS', []) - if FEATURES['ENABLE_CORS_HEADERS'] or FEATURES.get('ENABLE_CROSS_DOMAIN_CSRF_COOKIE'): CORS_ALLOW_CREDENTIALS = True CORS_ORIGIN_WHITELIST = _YAML_TOKENS.get('CORS_ORIGIN_WHITELIST', ())