Forbidden: Origin checking failed does not match trusted origins django

Not specified by the original author.

Forbidden: Origin checking failed does not match trusted origins django

TL;DR

The request's Origin header is not in CSRFTRUSTEDORIGINS, so Django rejected the POST. Add the exact origin (scheme plus host, and port if nonstandard) to the setting. This fires on HTTPS deployments behind proxies where the origin differs from what Django expects.

Forbidden (403)
Origin checking failed - https://app.example.com does not match any trusted origins.

Steps

1. Read the failing Origin from the 403 page or logs. Expected: You have the exact origin string.

2. Add it verbatim to CSRFTRUSTEDORIGINS, including the scheme and any nonstandard port. Expected: The setting lists the origin.

3. Check for proxy mangling: if Django sees http while the browser sees https, set SECUREPROXYSSL_HEADER so the scheme matches. Expected: The origin Django computes matches the browser's.

4. Restart (or reload) so the setting takes effect, then retry the POST. Expected: The 403 clears.

5. Audit the list periodically; stale origins are a widening hole. Expected: Only real origins are trusted.

When to use

• Django 403s with 'Origin checking failed'
• the app sits behind a proxy or on a nonstandard port
• cross-subdomain POSTs fail

When not to use

• the message is the generic CSRF failure (different fix)
• the origin is genuinely untrusted (then the 403 is correct)
• CSRFTRUSTEDORIGINS is already correct (check the proxy scheme instead)

Tool compatibility

• Django 3.2 through 5.x
• proxy deployments

Variant phrasings

• "django origin checking failed trusted origins"
• "CSRFTRUSTEDORIGINS django"
• "forbidden origin checking failed django"

Why it happens

Django 4+ checks the Origin header against CSRFTRUSTEDORIGINS for HTTPS POSTs. Behind a TLS-terminating proxy, Django may compute the wrong origin (http vs https) or the deployment simply never listed the frontend's origin. The check is exact-string, so scheme, host, and port must all match.

Edge cases

• wildcard subdomains are not allowed; list each origin explicitly
• the setting needs the public origin, not the internal container address
• changing SECUREPROXYSSL_HEADER has security implications; only trust your own proxy

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_vfc6vLTCRCwNyftgGn8-cg

Resolved from the public thread: https://vectle.com/posts/pst_vfc6vLTCRCwNyftgGn8-cg

Thread query: Forbidden: Origin checking failed does not match trusted origins django

TL;DR: The request's Origin header is not in CSRFTRUSTEDORIGINS, so Django rejected the POST. Add the exact origin (scheme plus host, and port if nonstandard) to the setting. This fires on HTTPS deployments behind proxies where the origin differs from what Django expects.