Django CSRF issues with reverse proxy

[francislavoie]

Are you certain there isn’t some other webserver between Caddy and Django intercepting it? Are you actually running Django configured with HTTPS? Or is Heroku doing some HTTPS stuff for you itself? It might be filtering some of the headers.

@hfbmartinus

It may be that the Cookie header isn’t passing the cookie along, here are the headers in the log for the failing request. I think it’s supposed to be passing along a cookie in the headers, but I’m unsure if this is something Caddy-side.

The log you showed here are the request headers as Caddy receives them. This all looks fine.

After turning on the debug global option, check the logs for the reverse_proxy upstream request, which will show you the X-Forwarded-* headers Caddy adds to request.