CORS_REPLACE_HTTPS_REFERER not working with DRF: SessionAuthentication about django-cors-headers HOT 6 CLOSED

Since Django 1.8 support will be dropped shortly, I don't want to include it in the library. Copying that snippet should be easy enough for most projects.

from django-cors-headers.

Using this SessionAuthentication class for DRF mitigates the problem.
Could this be included in cors-headers?

from corsheaders import defaults as settings
from corsheaders.middleware import (
    CorsPostCsrfMiddleware, CorsMiddleware)
from rest_framework.authentication import (
    SessionAuthentication as RFSessionAuthentication)


class PatchDepatchRefererCsrf(CorsMiddleware, CorsPostCsrfMiddleware):
    """
    Helper class to provide access to _https_referer_replace
    and _https_referer_replace_reverse.
    """

    def patch(self, request):
        if self.is_enabled(request) and settings.CORS_REPLACE_HTTPS_REFERER:
            self._https_referer_replace(request)

    def depatch(self, request):
        self._https_referer_replace_reverse(request)


class SessionAuthentication(RFSessionAuthentication):
    """
    SessionAuthentication that patchess the HTTP_REFERER before checking
    CSRF and depatch it after checking it.

    corsheaders supplies middleware but DRF doesn't use the middleware
    when checking CSRF for itself. This creates a problem when using https.
    """
    def enforce_csrf(self, request):
        patch_depatch = PatchDepatchRefererCsrf()
        patch_depatch.patch(request)
        super(SessionAuthentication, self).enforce_csrf(request)
        patch_depatch.depatch(request)

from django-cors-headers.

I'm sorry, I'm not familiar with the REST framework. Are you saying it bypasses the middleware stack entirely?

from django-cors-headers.

Are you saying it bypasses the middleware stack entirely?

It looks like turning CORS_REPLACE_HTTPS_REFERER on has no effect on Django REST Framework. I was still getting errors relating to the HTTP referer not matching the original hostname.

from django-cors-headers.

I think CORS_REPLACE_HTTPS_REFERER is only needed on Django 1.8, since CSRF_TRUSTED_ORIGINS can be used on 1.9+ (this is from re-reading the docs, I've forgotten how this feature ever worked). Does that setting work for your situation @avorio ?

from django-cors-headers.

I think CORS_REPLACE_HTTPS_REFERER is only needed on Django 1.8, since CSRF_TRUSTED_ORIGINS can be used on 1.9+ (this is from re-reading the docs, I've forgotten how this feature ever worked). Does that setting work for your situation @avorio ?

I am indeed using Django 1.8, so that feature would be great there. The problem is: it's not working as it is, so I ended up using something along the lines of @rvanlaar 's solution.

Could we bake that into the core django-cors-headers somehow?

from django-cors-headers.