{"action":"created","comment":{"url":"https://api.github.com/repos/django/django/pulls/comments/38574533","id":38574533,"diff_hunk":"@@ -428,6 +428,22 @@ any hyphens with underscores, and adding an ``'HTTP_'`` prefix to the name.\n For example, if your client sends a ``'X-XSRF-TOKEN'`` header, the setting\n should be ``'HTTP_X_XSRF_TOKEN'``.\n \n+.. setting:: CSRF_TRUSTED_ORIGINS\n+\n+CSRF_TRUSTED_ORIGINS\n+--------------------\n+\n+.. versionadded:: 1.9\n+\n+Default: ``[]`` (Empty list)\n+\n+A list of hosts which are trusted origins for unsafe (e.g. `POST`) requests.\n+By default, Django's CSRF protection requires that under HTTPS an unsafe\n+request must come from your same domain. If you need cross-origin unsafe\n+requests over HTTPS, include the source hosts in this setting. Don't include\n+any host in this setting that you don't control or trust to not CSRF your","path":"docs/ref/settings.txt","position":null,"original_position":17,"commit_id":"72c0a5f78c5d808441f58f67e6d998b254433d7d","original_commit_id":"eaf6958853768420d5166155d472b127955712c6","user":{"login":"timgraham","id":411869,"avatar_url":"https://avatars.githubusercontent.com/u/411869?v=3","gravatar_id":"","url":"https://api.github.com/users/timgraham","html_url":"https://github.com/timgraham","followers_url":"https://api.github.com/users/timgraham/followers","following_url":"https://api.github.com/users/timgraham/following{/other_user}","gists_url":"https://api.github.com/users/timgraham/gists{/gist_id}","starred_url":"https://api.github.com/users/timgraham/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timgraham/subscriptions","organizations_url":"https://api.github.com/users/timgraham/orgs","repos_url":"https://api.github.com/users/timgraham/repos","events_url":"https://api.github.com/users/timgraham/events{/privacy}","received_events_url":"https://api.github.com/users/timgraham/received_events","type":"User","site_admin":false},"body":"\"not to commit a CSRF attack against your site\"? (is CSRF often used as a verb?)","created_at":"2015-09-02T19:37:17Z","updated_at":"2015-09-02T19:37:17Z","html_url":"https://github.com/django/django/pull/5218#discussion_r38574533","pull_request_url":"https://api.github.com/repos/django/django/pulls/5218","_links":{"self":{"href":"https://api.github.com/repos/django/django/pulls/comments/38574533"},"html":{"href":"https://github.com/django/django/pull/5218#discussion_r38574533"},"pull_request":{"href":"https://api.github.com/repos/django/django/pulls/5218"}}},"pull_request":{"url":"https://api.github.com/repos/django/django/pulls/5218","id":43832253,"html_url":"https://github.com/django/django/pull/5218","diff_url":"https://github.com/django/django/pull/5218.diff","patch_url":"https://github.com/django/django/pull/5218.patch","issue_url":"https://api.github.com/repos/django/django/issues/5218","number":5218,"state":"open","locked":false,"title":"Fixed #25334 -- Added CSRF_TRUSTED_ORIGINS setting and logic","user":{"login":"joshkehn","id":272377,"avatar_url":"https://avatars.githubusercontent.com/u/272377?v=3","gravatar_id":"","url":"https://api.github.com/users/joshkehn","html_url":"https://github.com/joshkehn","followers_url":"https://api.github.com/users/joshkehn/followers","following_url":"https://api.github.com/users/joshkehn/following{/other_user}","gists_url":"https://api.github.com/users/joshkehn/gists{/gist_id}","starred_url":"https://api.github.com/users/joshkehn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshkehn/subscriptions","organizations_url":"https://api.github.com/users/joshkehn/orgs","repos_url":"https://api.github.com/users/joshkehn/repos","events_url":"https://api.github.com/users/joshkehn/events{/privacy}","received_events_url":"https://api.github.com/users/joshkehn/received_events","type":"User","site_admin":false},"body":"This patch adds a new setting, `CSRF_TRUSTED_ORIGINS`, which contains a\r\nlist of other domains that are included during the CSRF Referer header\r\nverification for secure (HTTPS) requests.\r\n\r\nTests and documentation have been updated.","created_at":"2015-09-01T02:46:36Z","updated_at":"2015-09-02T19:37:17Z","closed_at":null,"merged_at":null,"merge_commit_sha":"ccf4f69bebb99159bf708a2b86dcb9c09c5a8ebd","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/django/django/pulls/5218/commits","review_comments_url":"https://api.github.com/repos/django/django/pulls/5218/comments","review_comment_url":"https://api.github.com/repos/django/django/pulls/comments{/number}","comments_url":"https://api.github.com/repos/django/django/issues/5218/comments","statuses_url":"https://api.github.com/repos/django/django/statuses/72c0a5f78c5d808441f58f67e6d998b254433d7d","head":{"label":"joshkehn:24496_csrf_trusted_origins","ref":"24496_csrf_trusted_origins","sha":"72c0a5f78c5d808441f58f67e6d998b254433d7d","user":{"login":"joshkehn","id":272377,"avatar_url":"https://avatars.githubusercontent.com/u/272377?v=3","gravatar_id":"","url":"https://api.github.com/users/joshkehn","html_url":"https://github.com/joshkehn","followers_url":"https://api.github.com/users/joshkehn/followers","following_url":"https://api.github.com/users/joshkehn/following{/other_user}","gists_url":"https://api.github.com/users/joshkehn/gists{/gist_id}","starred_url":"https://api.github.com/users/joshkehn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshkehn/subscriptions","organizations_url":"https://api.github.com/users/joshkehn/orgs","repos_url":"https://api.github.com/users/joshkehn/repos","events_url":"https://api.github.com/users/joshkehn/events{/privacy}","received_events_url":"https://api.github.com/users/joshkehn/received_events","type":"User","site_admin":false},"repo":{"id":41711206,"name":"django","full_name":"joshkehn/django","owner":{"login":"joshkehn","id":272377,"avatar_url":"https://avatars.githubusercontent.com/u/272377?v=3","gravatar_id":"","url":"https://api.github.com/users/joshkehn","html_url":"https://github.com/joshkehn","followers_url":"https://api.github.com/users/joshkehn/followers","following_url":"https://api.github.com/users/joshkehn/following{/other_user}","gists_url":"https://api.github.com/users/joshkehn/gists{/gist_id}","starred_url":"https://api.github.com/users/joshkehn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshkehn/subscriptions","organizations_url":"https://api.github.com/users/joshkehn/orgs","repos_url":"https://api.github.com/users/joshkehn/repos","events_url":"https://api.github.com/users/joshkehn/events{/privacy}","received_events_url":"https://api.github.com/users/joshkehn/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/joshkehn/django","description":"The Web framework for perfectionists with deadlines.","fork":true,"url":"https://api.github.com/repos/joshkehn/django","forks_url":"https://api.github.com/repos/joshkehn/django/forks","keys_url":"https://api.github.com/repos/joshkehn/django/keys{/key_id}","collaborators_url":"https://api.github.com/repos/joshkehn/django/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/joshkehn/django/teams","hooks_url":"https://api.github.com/repos/joshkehn/django/hooks","issue_events_url":"https://api.github.com/repos/joshkehn/django/issues/events{/number}","events_url":"https://api.github.com/repos/joshkehn/django/events","assignees_url":"https://api.github.com/repos/joshkehn/django/assignees{/user}","branches_url":"https://api.github.com/repos/joshkehn/django/branches{/branch}","tags_url":"https://api.github.com/repos/joshkehn/django/tags","blobs_url":"https://api.github.com/repos/joshkehn/django/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/joshkehn/django/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/joshkehn/django/git/refs{/sha}","trees_url":"https://api.github.com/repos/joshkehn/django/git/trees{/sha}","statuses_url":"https://api.github.com/repos/joshkehn/django/statuses/{sha}","languages_url":"https://api.github.com/repos/joshkehn/django/languages","stargazers_url":"https://api.github.com/repos/joshkehn/django/stargazers","contributors_url":"https://api.github.com/repos/joshkehn/django/contributors","subscribers_url":"https://api.github.com/repos/joshkehn/django/subscribers","subscription_url":"https://api.github.com/repos/joshkehn/django/subscription","commits_url":"https://api.github.com/repos/joshkehn/django/commits{/sha}","git_commits_url":"https://api.github.com/repos/joshkehn/django/git/commits{/sha}","comments_url":"https://api.github.com/repos/joshkehn/django/comments{/number}","issue_comment_url":"https://api.github.com/repos/joshkehn/django/issues/comments{/number}","contents_url":"https://api.github.com/repos/joshkehn/django/contents/{+path}","compare_url":"https://api.github.com/repos/joshkehn/django/compare/{base}...{head}","merges_url":"https://api.github.com/repos/joshkehn/django/merges","archive_url":"https://api.github.com/repos/joshkehn/django/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/joshkehn/django/downloads","issues_url":"https://api.github.com/repos/joshkehn/django/issues{/number}","pulls_url":"https://api.github.com/repos/joshkehn/django/pulls{/number}","milestones_url":"https://api.github.com/repos/joshkehn/django/milestones{/number}","notifications_url":"https://api.github.com/repos/joshkehn/django/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/joshkehn/django/labels{/name}","releases_url":"https://api.github.com/repos/joshkehn/django/releases{/id}","created_at":"2015-09-01T02:04:07Z","updated_at":"2015-09-01T02:04:22Z","pushed_at":"2015-09-02T19:34:37Z","git_url":"git://github.com/joshkehn/django.git","ssh_url":"git@github.com:joshkehn/django.git","clone_url":"https://github.com/joshkehn/django.git","svn_url":"https://github.com/joshkehn/django","homepage":"https://www.djangoproject.com/","size":144758,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"django:master","ref":"master","sha":"6a98396b9da56bf5eb1c94e037b844eb9bdd1a45","user":{"login":"django","id":27804,"avatar_url":"https://avatars.githubusercontent.com/u/27804?v=3","gravatar_id":"","url":"https://api.github.com/users/django","html_url":"https://github.com/django","followers_url":"https://api.github.com/users/django/followers","following_url":"https://api.github.com/users/django/following{/other_user}","gists_url":"https://api.github.com/users/django/gists{/gist_id}","starred_url":"https://api.github.com/users/django/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/django/subscriptions","organizations_url":"https://api.github.com/users/django/orgs","repos_url":"https://api.github.com/users/django/repos","events_url":"https://api.github.com/users/django/events{/privacy}","received_events_url":"https://api.github.com/users/django/received_events","type":"Organization","site_admin":false},"repo":{"id":4164482,"name":"django","full_name":"django/django","owner":{"login":"django","id":27804,"avatar_url":"https://avatars.githubusercontent.com/u/27804?v=3","gravatar_id":"","url":"https://api.github.com/users/django","html_url":"https://github.com/django","followers_url":"https://api.github.com/users/django/followers","following_url":"https://api.github.com/users/django/following{/other_user}","gists_url":"https://api.github.com/users/django/gists{/gist_id}","starred_url":"https://api.github.com/users/django/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/django/subscriptions","organizations_url":"https://api.github.com/users/django/orgs","repos_url":"https://api.github.com/users/django/repos","events_url":"https://api.github.com/users/django/events{/privacy}","received_events_url":"https://api.github.com/users/django/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/django/django","description":"The Web framework for perfectionists with deadlines.","fork":false,"url":"https://api.github.com/repos/django/django","forks_url":"https://api.github.com/repos/django/django/forks","keys_url":"https://api.github.com/repos/django/django/keys{/key_id}","collaborators_url":"https://api.github.com/repos/django/django/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/django/django/teams","hooks_url":"https://api.github.com/repos/django/django/hooks","issue_events_url":"https://api.github.com/repos/django/django/issues/events{/number}","events_url":"https://api.github.com/repos/django/django/events","assignees_url":"https://api.github.com/repos/django/django/assignees{/user}","branches_url":"https://api.github.com/repos/django/django/branches{/branch}","tags_url":"https://api.github.com/repos/django/django/tags","blobs_url":"https://api.github.com/repos/django/django/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/django/django/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/django/django/git/refs{/sha}","trees_url":"https://api.github.com/repos/django/django/git/trees{/sha}","statuses_url":"https://api.github.com/repos/django/django/statuses/{sha}","languages_url":"https://api.github.com/repos/django/django/languages","stargazers_url":"https://api.github.com/repos/django/django/stargazers","contributors_url":"https://api.github.com/repos/django/django/contributors","subscribers_url":"https://api.github.com/repos/django/django/subscribers","subscription_url":"https://api.github.com/repos/django/django/subscription","commits_url":"https://api.github.com/repos/django/django/commits{/sha}","git_commits_url":"https://api.github.com/repos/django/django/git/commits{/sha}","comments_url":"https://api.github.com/repos/django/django/comments{/number}","issue_comment_url":"https://api.github.com/repos/django/django/issues/comments{/number}","contents_url":"https://api.github.com/repos/django/django/contents/{+path}","compare_url":"https://api.github.com/repos/django/django/compare/{base}...{head}","merges_url":"https://api.github.com/repos/django/django/merges","archive_url":"https://api.github.com/repos/django/django/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/django/django/downloads","issues_url":"https://api.github.com/repos/django/django/issues{/number}","pulls_url":"https://api.github.com/repos/django/django/pulls{/number}","milestones_url":"https://api.github.com/repos/django/django/milestones{/number}","notifications_url":"https://api.github.com/repos/django/django/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/django/django/labels{/name}","releases_url":"https://api.github.com/repos/django/django/releases{/id}","created_at":"2012-04-28T02:47:18Z","updated_at":"2015-09-02T19:27:04Z","pushed_at":"2015-09-02T19:34:42Z","git_url":"git://github.com/django/django.git","ssh_url":"git@github.com:django/django.git","clone_url":"https://github.com/django/django.git","svn_url":"https://github.com/django/django","homepage":"https://www.djangoproject.com/","size":312122,"stargazers_count":15792,"watchers_count":15792,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":6330,"mirror_url":null,"open_issues_count":75,"forks":6330,"open_issues":75,"watchers":15792,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/django/django/pulls/5218"},"html":{"href":"https://github.com/django/django/pull/5218"},"issue":{"href":"https://api.github.com/repos/django/django/issues/5218"},"comments":{"href":"https://api.github.com/repos/django/django/issues/5218/comments"},"review_comments":{"href":"https://api.github.com/repos/django/django/pulls/5218/comments"},"review_comment":{"href":"https://api.github.com/repos/django/django/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/django/django/pulls/5218/commits"},"statuses":{"href":"https://api.github.com/repos/django/django/statuses/72c0a5f78c5d808441f58f67e6d998b254433d7d"}}}}