using AWS cloudfront with Django - CSRF failures

[John Briere]

I'm sure there's simple solution for this but I haven't found it. AWS Cloudfront strips out the referer header: 

http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/RequestAndResponseBehaviorCustomOrigin.html#RequestCustomRemovedHeaders

Django requires a referer to exist and to match the current site as part of CSRF protection: 

https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#how-it-works

Immediate issue is that /admin doesn't work at all, but even if I exclude /admin from being behind Cloudfront, what about other forms that users will interact with?  

thanks- John 

[João Figueiredo]

Hi John, 

Even though I'm two years late, in case someone runs into this problem I managed to solve it by:

Whitelisting the 'x-csrfmiddlewaretoken' header (i.e. gets properly forwarded to origin) in the distribution settings.

Whitelisting the 'csrftoken' cookie in the distribution behaviour.

Best,

Joao