Tag See all →

#https

2 stories

Banner: Django CSRF Origin checking failed behind a TLS-terminating reverse proxy

Web Development Bug Report

Django CSRF verification failed: Origin checking failed behind an HTTPS proxy

Daniel Tran · Apr 2, 2025 · 9 min read

Every POST to our Django admin returned 403 after we moved TLS termination to a Traefik ingress. Django compared the browser's https Origin with a request it believed was plain http. Two settings fixed it without weakening CSRF.

Banner: Cloudflare Flexible SSL and an origin HTTPS redirect creating an endless redirect loop

Networking & DNS Bug Report

Cloudflare ERR_TOO_MANY_REDIRECTS with Flexible SSL and an HTTPS-forcing origin

Daniel Tran · Feb 6, 2025 · 8 min read

Minutes after we proxied our marketing site through Cloudflare, every visitor hit ERR_TOO_MANY_REDIRECTS. Cloudflare's Flexible mode spoke plain HTTP to an origin that redirected all HTTP to HTTPS. Full (strict) with an origin certificate ended the loop.