[Django] #35328: Improve CSRF Origin checking messaging

[Django]

#35328: Improve CSRF Origin checking messaging
----------------------------------------+--------------------------
Reporter: Ryan Hiebert | Owner: nobody
Type: New feature | Status: assigned
Component: CSRF | Version: dev
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 1
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
----------------------------------------+--------------------------
A very common misconfiguration is for the
`SECURE_PROXY_SSL_HEADER` setting to not be configured correctly. This
causes the origin checks to fail, but the messaging leads folks like me to
the `CSRF_TRUSTED_ORIGINS` setting, which is not really what you want in
this scenario. In some cases, like GitHub Codespaces, you may also need
the `USE_X_FORWARDED_HOST` setting as well.

I believe we can make some common scenarios easier to fix by improving our
error messaging. Particularly in `DEBUG` mode, we can show useful
information about their headers and give a suggestion about what fix might
be appropriate.

https://forum.djangoproject.com/t/forwarded-headers-csrf-hints/28616
--
Ticket URL: <https://code.djangoproject.com/ticket/35328>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#35328: Improve CSRF Origin checking messaging

--------------------------------------+------------------------------------

Reporter: Ryan Hiebert | Owner: nobody

Type: Cleanup/optimization | Status: assigned
Component: CSRF | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted

Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

--------------------------------------+------------------------------------
Changes (by Natalia Bidart):

* cc: Carlton Gibson, tim-schilling (added)
* stage: Unreviewed => Accepted
* type: New feature => Cleanup/optimization

Comment:

Accepting following the linked Forum discussion.
--
Ticket URL: <https://code.djangoproject.com/ticket/35328#comment:1>

[Django]

#35328: Improve CSRF Origin checking messaging
--------------------------------------+------------------------------------
Reporter: Ryan Hiebert | Owner: nobody
Type: Cleanup/optimization | Status: assigned
Component: CSRF | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 1

Easy pickings: 0 | UI/UX: 0
--------------------------------------+------------------------------------

Changes (by Mariusz Felisiak):

* needs_better_patch: 0 => 1

--
Ticket URL: <https://code.djangoproject.com/ticket/35328#comment:2>

[Django]

#35328: Improve CSRF Origin checking messaging
--------------------------------------+------------------------------------
Reporter: Ryan Hiebert | Owner: nobody
Type: Cleanup/optimization | Status: assigned
Component: CSRF | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0

Easy pickings: 0 | UI/UX: 0
--------------------------------------+------------------------------------

Changes (by Ryan Hiebert):

* needs_better_patch: 1 => 0

--
Ticket URL: <https://code.djangoproject.com/ticket/35328#comment:3>

[Django]

#35328: Improve CSRF Origin checking messaging

-------------------------------------+-------------------------------------
Reporter: Ryan Hiebert | Owner: Ryan
Type: | Hiebert

Cleanup/optimization | Status: assigned
Component: CSRF | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

-------------------------------------+-------------------------------------
Changes (by Ryan Hiebert):

* owner: nobody => Ryan Hiebert

--
Ticket URL: <https://code.djangoproject.com/ticket/35328#comment:4>

[Django]

#35328: Improve CSRF Origin checking messaging
-------------------------------------+-------------------------------------
Reporter: Ryan Hiebert | Owner: Ryan
Type: | Hiebert
Cleanup/optimization | Status: assigned
Component: CSRF | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 1

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Sarah Boyce):

* needs_better_patch: 0 => 1

--
Ticket URL: <https://code.djangoproject.com/ticket/35328#comment:5>

[Django]

#35328: Improve CSRF Origin checking messaging
-------------------------------------+-------------------------------------
Reporter: Ryan Hiebert | Owner: Ryan
Type: | Hiebert
Cleanup/optimization | Status: assigned
Component: CSRF | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Ryan Hiebert):

* needs_better_patch: 1 => 0

--
Ticket URL: <https://code.djangoproject.com/ticket/35328#comment:6>

[Django]

#35328: Improve CSRF Origin checking messaging
-------------------------------------+-------------------------------------
Reporter: Ryan Hiebert | Owner: Ryan
Type: | Hiebert
Cleanup/optimization | Status: assigned
Component: CSRF | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 1

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Sarah Boyce):

* needs_better_patch: 0 => 1

--
Ticket URL: <https://code.djangoproject.com/ticket/35328#comment:7>

[Django]

#35328: Improve CSRF Origin checking messaging
-------------------------------------+-------------------------------------
Reporter: Ryan Hiebert | Owner: Ryan
Type: | Hiebert
Cleanup/optimization | Status: assigned
Component: CSRF | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Ryan Hiebert):

* needs_better_patch: 1 => 0

--
Ticket URL: <https://code.djangoproject.com/ticket/35328#comment:8>

[Django]

#35328: Improve CSRF Origin checking messaging
-------------------------------------+-------------------------------------
Reporter: Ryan Hiebert | Owner: Ryan
Type: | Hiebert
Cleanup/optimization | Status: assigned
Component: CSRF | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 1

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Sarah Boyce):

* needs_better_patch: 0 => 1

--
Ticket URL: <https://code.djangoproject.com/ticket/35328#comment:9>