Add django CSRF setting (GoogleCloudPlatform#7412)

glasnt · leahecole · web-flow · commit 9a97472106cf · 2022-02-02T13:40:27.000-08:00
* Add django CSRF setting

* lint

Co-authored-by: Leah E. Cole &lt;6719667+leahecole@users.noreply.github.com&gt;
diff --git a/appengine/standard_python3/django/app.yaml b/appengine/standard_python3/django/app.yaml
@@ -18,6 +18,10 @@
 # [START gaestd_py_django_app_yaml]
 runtime: python39
 
+env_variables:
+  # This setting is used in settings.py to configure your ALLOWED_HOSTS
+  # APPENGINE_URL: https://PROJECT_ID.uc.r.appspot.com
+
 handlers:
 # This configures Google App Engine to serve the files in the app's static
 # directory.
diff --git a/appengine/standard_python3/django/mysite/settings.py b/appengine/standard_python3/django/mysite/settings.py
@@ -14,6 +14,7 @@
 
 import io
 import os
+from urllib.parse import urlparse
 
 import environ
 from google.cloud import secretmanager
@@ -59,10 +60,22 @@
 # Change this to "False" when you are ready for production
 DEBUG = env("DEBUG")
 
-# SECURITY WARNING: App Engine's security features ensure that it is safe to
-# have ALLOWED_HOSTS = ['*'] when the app is deployed. If you deploy a Django
-# app not on App Engine, make sure to set an appropriate host here.
-ALLOWED_HOSTS = ["*"]
+
+# [START gaestd_py_django_csrf]
+# SECURITY WARNING: It's recommended that you use this when
+# running in production. The URL will be known once you first deploy
+# to App Engine. This code takes the URL and converts it to both these settings formats.
+APPENGINE_URL = env("APPENGINE_URL", default=None)
+if APPENGINE_URL:
+    # Ensure the HTTPS is in the URL before it's used.
+    APPENGINE_URL = urlparse(APPENGINE_URL, "https").geturl()
+
+    ALLOWED_HOSTS = [APPENGINE_URL]
+    CSRF_TRUSTED_ORIGINS = [urlparse(APPENGINE_URL).netloc]
+    SECURE_SSL_REDIRECT = True
+else:
+    ALLOWED_HOSTS = ["*"]
+# [END gaestd_py_django_csrf]
 
 # Application definition
 
diff --git a/run/django/mysite/settings.py b/run/django/mysite/settings.py
@@ -14,6 +14,7 @@
 
 import io
 import os
+from urllib.parse import urlparse
 
 import environ
 import google.auth
@@ -65,10 +66,18 @@
 
 DEBUG = env("DEBUG")
 
-# SECURITY WARNING: It's recommended that you change this setting when
+# [START cloudrun_django_csrf]
+# SECURITY WARNING: It's recommended that you use this when
 # running in production. The URL will be known once you first deploy
-# to Cloud Run.
-ALLOWED_HOSTS = ["*"]
+# to Cloud Run. This code takes the URL and converts it to both these settings formats.
+CLOUDRUN_SERVICE_URL = env("CLOUDRUN_SERVICE_URL", default=None)
+if CLOUDRUN_SERVICE_URL:
+    ALLOWED_HOSTS = [urlparse(CLOUDRUN_SERVICE_URL).netloc]
+    CSRF_TRUSTED_ORIGINS = [CLOUDRUN_SERVICE_URL]
+    SECURE_SSL_REDIRECT = True
+else:
+    ALLOWED_HOSTS = ["*"]
+# [END cloudrun_django_csrf]
 
 # Application definition
 
