ottoyiu/django-cors-headers — pull request #43 by robustican (2014-10-16 17:38:26+00:00)
Title: Feature to allow module to work with CSRF over https

Over https, django csrf middleware compares the HTTP_HOST and the HTTP_REFERER. So even with the corsheaders middleware enabled, csrf checks still fail.

This pull request adds the CORS_REPLACE_HTTPS_REFERER setting, which will replace the HTTP_REFERER header with something that will match HTTP_HOST so django's csrf check succeeds if the cors checks succeed.

In order that this solution impact the processing pipeline as little as possible, I've also added a small middleware class, CorsPostCsrfMiddleware, that returns request.META to its original state. This should be added directly after the CSRF middleware is run.