cross-site post form submissions are forbidden

Short answer: tell Django which origins may post to it. Add the posting origin to CSRF_TRUSTED_ORIGINS in settings and restart. `` Forbidden (403) CSRF verification failed. Request aborted. Reason given for failure: Origin checking failed - https://example.com does not match any trusted origins. The page title on that 403 reads "cross-site post form submissions are forbidden". 1. In settings add: CSRFTRUSTEDORIGINS = ["https://example.com"], using the exact scheme and host the browser posts from. Restart the app server. Expected: the setting takes effect on restart. 2. Make sure the form renders the token tag. Without it every POST fails, trusted origin or not. 3. Behind a proxy, confirm the app sees the real scheme and host through forwarded headers. If the app thinks the host is the internal one, the origin check compares against the wrong value. 4. Retry the POST. Expected: the normal redirect or response, no 403. Root cause: the middleware's origin check is an allowlist. A missing or mismatched entry looks exactly like a forged cross-site POST, so it is rejected by design. When to use: Django 4 and later deployments where the form page and the POST target differ by host, scheme, or port. When NOT to use: same-origin POSTs failing are usually a missing CSRF token, not this error. Variant phrasings: "django 403 csrf verification failed", "origin checking failed django", "django csrf trusted origins". Edge cases: entries need the scheme (https://`), a bare hostname never matches. Do not disable the middleware to make this go away, you would be turning off forgery protection for every form.

Context: This is Django's CsrfViewMiddleware rejecting a POST. Django only accepts POSTs from the current host or from origins you explicitly trust. When the form is served from one host, scheme, or port and posted to another (a separate frontend domain, a proxy, a port change), the middleware treats it as a cross-site forgery attempt and answers 403.