title: Django - how to disable Referer check
body: <p>I have put a Django-based web project (Cloudera Hue: <a href="https://github.com/cloudera/hue" rel="nofollow noreferrer">https://github.com/cloudera/hue</a>) behind nginx used for load balancing and SSL offloading.</p>
  <p>Getting stuck on 403 error with CSRF error.
  Log file contains</p>
  <blockquote>
  <p>5:32:32 PM    WARNING access<br />
  10.170.3.21 -anon- - &quot;POST /accounts/login/ HTTP/1.1&quot; -- Referer checking failed -
  <a href="https://hue-dev.discover.abc.com/hue/accounts/login/?next=/" rel="nofollow noreferrer">https://hue-dev.discover.abc.com/hue/accounts/login/?next=/</a> does not
  match <a href="https://hue-dev.discover.abc.com:443/" rel="nofollow noreferrer">https://hue-dev.discover.abc.com:443/</a>.</p>
  </blockquote>
  <p><strong>Is there is a way to disable Referer check in a Django project?</strong></p>
  <p>Referer check doesn't add any security as Referer in http header can be easily spoofed. <a href="https://security.stackexchange.com/questions/66165/does-referrer-header-checking-offer-any-real-world-security-improvement">https://security.stackexchange.com/questions/66165/does-referrer-header-checking-offer-any-real-world-security-improvement</a></p>
  <p>I already have following in nginx.conf</p>
  <pre><code>  proxy_set_header        Host $host;
  
    proxy_set_header        X-Real-IP $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header        X-Forwarded-Proto $scheme;
  
    proxy_set_header        X-Forwarded-Host $host:$server_port;
    proxy_set_header        X-Forwarded-Server $host;
  </code></pre>
  <p>and also tried following changes regarding Referer http attribute:</p>
  <ol>
  <li><code>proxy_pass_header       Referer</code></li>
  <li><code>proxy_hide_header       Referer</code></li>
  <li><code>proxy_set_header        $http_referer</code></li>
  </ol>
  <p>all of these options produce the same CSRF/Referer check error in Django/Hue backend.</p>
  <p>Again, for me it would be just easier to disable Referer check in Django.</p>
  <p>If it's not possible, then the issue is probably in Django code here:
  <a href="https://github.com/django/django/blob/22e8ab02863819093832de9f771bf40a62a6bd4a/django/middleware/csrf.py#L280" rel="nofollow noreferrer">https://github.com/django/django/blob/22e8ab02863819093832de9f771bf40a62a6bd4a/django/middleware/csrf.py#L280</a></p>
  <p><code>referer</code> variable there is a urlparse object (see <a href="https://docs.python.org/3/library/urllib.parse.html" rel="nofollow noreferrer">https://docs.python.org/3/library/urllib.parse.html</a> ) which contains &quot;netloc&quot; property with a <code>port</code>.</p>
  <p>Notice the error again - <code>netloc</code>s don't match because one has a port (443) and another doesn't have it (443 port is default for https):</p>
  <blockquote>
  <p>Referer checking failed -</p>
  <p><a href="https://hue-dev.discover.abc.com/hue/accounts/login/?next=/" rel="nofollow noreferrer">https://hue-dev.discover.abc.com/hue/accounts/login/?next=/</a><br />
  does not match<br />
  <a href="https://hue-dev.discover.abc.com:443/" rel="nofollow noreferrer">https://hue-dev.discover.abc.com:443/</a>.</p>
  </blockquote>
  <p>so I guess it should be some sort of <code>Referer</code> field transformation made in nginx config to cut out <code>443</code> port explicitly (or add it).</p>
  <p>Also posted Django bug here - <a href="https://code.djangoproject.com/ticket/30017" rel="nofollow noreferrer">https://code.djangoproject.com/ticket/30017</a>
  but I guess there still could be a check do disable Referer check in Django, or
  at least redact Referer to cut/add port 443 for https through nginx configuration?</p>