Support proxy CSRF settings

CHANGELOG.md

@@ -20,6 +20,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - [#16](https://github.com/BIPLAT-CIBERINFEC/pathocore-api/pull/16) Add DRF throttling for public API endpoints.
 - [#17](https://github.com/BIPLAT-CIBERINFEC/pathocore-api/pull/17) Notify use-case admins of pending access requests
 - [#18](https://github.com/BIPLAT-CIBERINFEC/pathocore-api/pull/18) Use English copy in API response payloads
+- [#26](https://github.com/BIPLAT-CIBERINFEC/pathocore-api/pull/26) Support proxy CSRF settings for admin and Swagger login
 
 ### `Fixed`
 

README.md

@@ -253,11 +253,18 @@ production it should point to the agreed database host.
 |---|---|---|
 | `PATHOCORE_API_LOCAL_SERVER_IP` | `127.0.0.1` | Host/IP inserted into Django `ALLOWED_HOSTS`. |
 | `PATHOCORE_API_DNS_URL` | `mepram-api-pathocore.<domain>` | Public API hostname inserted into Django `ALLOWED_HOSTS`. |
+| `PATHOCORE_API_ALLOWED_HOSTS` | `localhost,127.0.0.1,api.<domain>` | Optional comma-separated override for Django `ALLOWED_HOSTS`. |
+| `PATHOCORE_API_CSRF_TRUSTED_ORIGINS` | `https://api.<domain>` | Public HTTPS origins trusted by Django forms such as admin and Swagger login. |
 
 These values configure what hostnames the API considers valid. When the API is
 deployed behind the `pathocore-web` orchestrator, the orchestrator passes these
 values to the API installer.
 
+When the API is deployed behind Apache or another reverse proxy, set
+`PATHOCORE_API_CSRF_TRUSTED_ORIGINS` to the public API origin. The API trusts the
+proxy-provided `X-Forwarded-Proto` and `X-Forwarded-Host` headers so Django can
+validate HTTPS form submissions correctly.
+
 ### Keycloak Settings
 
 | Variable | Example | Purpose |

conf/docker_production_settings.txt

@@ -16,6 +16,8 @@ DB_PORT=3306
 ### Public host settings
 PATHOCORE_API_LOCAL_SERVER_IP='change_me_server_ip'
 PATHOCORE_API_DNS_URL='pathocore-api.example.org'
+PATHOCORE_API_ALLOWED_HOSTS=""
+PATHOCORE_API_CSRF_TRUSTED_ORIGINS="https://pathocore-api.example.org"
 
 ### Keycloak authentication settings
 PATHOCORE_ENABLE_LEGACY_BASIC_AUTH="false"

conf/docker_test_settings.txt

@@ -16,6 +16,8 @@ DB_PORT=3306
 ### PathoCore API host settings
 PATHOCORE_API_LOCAL_SERVER_IP='127.0.0.1'
 PATHOCORE_API_DNS_URL='localhost'
+PATHOCORE_API_ALLOWED_HOSTS=""
+PATHOCORE_API_CSRF_TRUSTED_ORIGINS="http://127.0.0.1:8000,http://localhost:8000"
 
 ### Keycloak authentication settings
 PATHOCORE_ENABLE_LEGACY_BASIC_AUTH="true"

conf/template_install_settings.txt

@@ -17,6 +17,8 @@ DB_PORT=3306
 ### Settings required for accessing pathocore-api
 PATHOCORE_API_LOCAL_SERVER_IP='<PathocoreAPI_IP>' # example: 172.0.0.1
 PATHOCORE_API_DNS_URL='<PathocoreAPI_url_address>' # example: pathocore-api.isciii.es
+PATHOCORE_API_ALLOWED_HOSTS="" # optional comma-separated override for Django ALLOWED_HOSTS
+PATHOCORE_API_CSRF_TRUSTED_ORIGINS="" # comma-separated public origins, for example: https://pathocore-api.isciii.es
 
 ### Keycloak authentication settings
 ### Runtime environment variables override these installed defaults.

conf/template_settings.py

@@ -57,6 +57,13 @@ def _rate_env(name, default):
     return os.environ.get(name, default).strip()
 
 
+def _csv_env(name, default=None):
+    raw_value = os.environ.get(name)
+    if not raw_value:
+        return list(default or [])
+    return [item.strip() for item in raw_value.split(",") if item.strip()]
+
+
 # Quick-start development settings - unsuitable for production
 # See https://docs.djangoproject.com/en/3.2/howto/deployment/checklist/
 
@@ -67,7 +74,13 @@ def _rate_env(name, default):
 # SECURITY WARNING: don"t run with debug turned on in production!
 DEBUG = _bool_env("DJANGO_DEBUG", True)
 
-ALLOWED_HOSTS = ["localhost", "127.0.0.1", "localserverip", "dns_url"]
+ALLOWED_HOSTS = _csv_env(
+    "PATHOCORE_API_ALLOWED_HOSTS",
+    ["localhost", "127.0.0.1", "localserverip", "dns_url"],
+)
+CSRF_TRUSTED_ORIGINS = _csv_env("PATHOCORE_API_CSRF_TRUSTED_ORIGINS")
+SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+USE_X_FORWARDED_HOST = True
 
 # Application definition
 INSTALLED_APPS = [

docker-compose.test.yml

@@ -40,6 +40,8 @@ services:
       PATHOCORE_ENABLE_LEGACY_BASIC_AUTH: ${PATHOCORE_ENABLE_LEGACY_BASIC_AUTH:-true}
       PATHOCORE_ENABLE_PUBLIC_READ_ENDPOINTS: ${PATHOCORE_ENABLE_PUBLIC_READ_ENDPOINTS:-true}
       PUBLIC_API_THROTTLE_RATE: ${PUBLIC_API_THROTTLE_RATE:-500/hour}
+      PATHOCORE_API_ALLOWED_HOSTS: ${PATHOCORE_API_ALLOWED_HOSTS:-}
+      PATHOCORE_API_CSRF_TRUSTED_ORIGINS: ${PATHOCORE_API_CSRF_TRUSTED_ORIGINS:-http://127.0.0.1:8000,http://localhost:8000}
       PATHOCORE_CREATE_DEFAULT_SUPERUSER: ${PATHOCORE_CREATE_DEFAULT_SUPERUSER:-true}
       DJANGO_SUPERUSER_USERNAME: ${DJANGO_SUPERUSER_USERNAME:-admin}
       DJANGO_SUPERUSER_EMAIL: ${DJANGO_SUPERUSER_EMAIL:-admin@example.org}

install.sh

@@ -108,6 +108,12 @@ write_runtime_env_file() {
         write_runtime_env_var \
             "PUBLIC_API_THROTTLE_RATE" \
             "${PUBLIC_API_THROTTLE_RATE:-500/hour}"
+        write_runtime_env_var \
+            "PATHOCORE_API_ALLOWED_HOSTS" \
+            "${PATHOCORE_API_ALLOWED_HOSTS:-}"
+        write_runtime_env_var \
+            "PATHOCORE_API_CSRF_TRUSTED_ORIGINS" \
+            "${PATHOCORE_API_CSRF_TRUSTED_ORIGINS:-}"
         write_runtime_env_var "DJANGO_DEBUG" "${DJANGO_DEBUG:-true}"
         write_runtime_env_var \
             "PATHOCORE_CREATE_DEFAULT_SUPERUSER" \