Allow setting CSRF_TRUSTED_ORIGINS from env

docs/deployment.rst

@@ -48,11 +48,11 @@ this:
 .. code-block:: text
 
     DJANGO_SECRET_KEY=replace-this-with-a-long-random-value
-    DJANGO_DEFAULT_FROM_EMAIL=comics@example.com
+    DJANGO_CSRF_TRUSTED_ORIGINS=https://comics.example.com
 
+    [email protected]
     # Sending email, alternative 1: Using a local SMTP server
     DJANGO_EMAIL_BACKEND=django.core.mail.backends.smtp.EmailBackend
-
     # Sending email, alternative 2: Using the SendGrid API
     SENDGRID_API_KEY=your-sendgrid-api-key
 

src/comics/settings.py

@@ -60,6 +60,14 @@
 ALLOWED_HOSTS = env.list("DJANGO_ALLOWED_HOSTS", default=["*"])
 
 
+# Security - Cross-Site Request Forgery (CSRF)
+#
+CSRF_TRUSTED_ORIGINS = env.list(
+    "DJANGO_CSRF_TRUSTED_ORIGINS",
+    default=["http://localhost:8000"],
+)
+
+
 # Security - Session
 #
 # Time the user session cookies will be valid. Default: 1 year