Repository: ocf/ocfweb

Issue:
CSRF token PR fails in prod due to referer checks
The cookies seem to be working properly, but referer checks are failing?

```
Jan 31 18:46:57 coma gunicorn[23653]: Forbidden (Referer checking failed - https://www.ocf.berkeley.edu/account/register/ does not match any trusted origins.): /account/register/
```

Explained in the docs:
https://docs.djangoproject.com/en/dev/ref/csrf/#how-it-works

Maybe the referer header is not what we think it is due to the proxying?

I reverted my change in 89a8931ff0fe9e511905780a42be24a63b1d5c9a



Discussion:
From some problem reports, it seems like we're getting reasonable referer headers:

```
 'HTTP_REFERER': 'https://www.ocf.berkeley.edu/account/register/',
```

...not sure what's going on really

I think [`CSRF_COOKIE_DOMAIN`](https://docs.djangoproject.com/en/1.9/ref/settings/#csrf-cookie-domain) might need to be set, because otherwise I think Django is trying to compare the absolute and relative paths and concludes that they are not equal because the CSRF cookies don't have a domain set by default? Not sure on this though, it's just a theory to try.

Might also (or instead) need to set [`CSRF_TRUSTED_ORIGINS`](https://docs.djangoproject.com/en/1.9/ref/settings/#csrf-trusted-origins) to include `www.ocf.berkeley.edu`?

@jvperrin my branch did set CSRF_COOKIE_DOMAIN when on prod, but I think you're probably right that we need to set CSRF_TRUSTED_ORIGINS too

want to try that? the jenkins PR tester builds a Debian package (at a URL like `https://jenkins.ocf.berkeley.edu/view/ocfweb-test-pr/job/ocfweb-test-pr-build-deb/54/artifact/ocfweb_2016.01.31.00.29-gitc4bbee0f_amd64.deb`) which you can wget onto coma and install manually.

If it doesn't work you can easily roll back by `apt-get install`-ing the current version from master

Oh, good point, I didn't see it there at the bottom. Yeah, I'll try that and see if it works after I get back from dinner.

@jvperrin sounds good, thanks!

Just FYI (not sure how familiar you are with git), the proper way to revert a revert commit in git is to... revert the revert commit. It makes a silly-looking commit like "Revert "Revert..."" but it works. Just mentioning this since often people will try to do things like try to grab back the original branch, apply changes, and then merge it again with a fix commit on top. But this won't work because when git applies changes from master, that includes reverting that branch already.


Resolving patch:
diff --git a/ocfweb/settings.py b/ocfweb/settings.py
--- a/ocfweb/settings.py
+++ b/ocfweb/settings.py
@@ -82,7 +82,13 @@ def __mod__(self, ref):
 SESSION_ENGINE = 'django.contrib.sessions.backends.cache'
 
 # XXX: DO NOT CHANGE
-# Ensure cookies can't be read by JavaScript.
+# Ensure cookies can't be read by JavaScript or users.
+# Our proxy filters cookies starting with "OCFWEB_" when going to user sites,
+# so it's important our cookies match this pattern.
+CSRF_COOKIE_HTTPONLY = True
+CSRF_COOKIE_SECURE = False
+CSRF_COOKIE_PATH = '/'
+CSRF_COOKIE_NAME = 'OCFWEB_CSRF_TOKEN'
 SESSION_COOKIE_HTTPONLY = True
 SESSION_COOKIE_SECURE = False
 SESSION_COOKIE_PATH = '/'
@@ -156,6 +162,9 @@ def __mod__(self, ref):
         }
     }
 
+    CSRF_COOKIE_SECURE = True
+    CSRF_COOKIE_DOMAIN = 'www.ocf.berkeley.edu'
+    CSRF_TRUSTED_ORIGINS = ['www.ocf.berkeley.edu']
     SESSION_COOKIE_SECURE = True
     SESSION_COOKIE_DOMAIN = 'www.ocf.berkeley.edu'
 else:


Test patch: