ottoyiu/django-cors-headers — pull request #47 by robustican (2014-12-14 22:36:58+00:00)
Title: rebased CORS_REPLACE_HTTPS_REFERER pull request

This is the rebased pull request for csrf and cors over https

Over https, django csrf middleware compares the HTTP_HOST and the HTTP_REFERER. So even with the corsheaders middleware enabled, csrf checks still fail.

This pull request adds the CORS_REPLACE_HTTPS_REFERER setting, which will replace the HTTP_REFERER header with something that will match HTTP_HOST so django's csrf check succeeds if the cors checks succeed.

In order that this solution impact the processing pipeline as little as possible, I've also added a small middleware class, CorsPostCsrfMiddleware, that returns request.META to its original state. This should be added directly after the CSRF middleware is run.