Problem with HTTPS/SSL, CSRF_TRUSTED_ORIGINS not working.

So I hit an issue while porting my site to use HTTPS.

Everything worked fine with HTTP but after switching to HTTPS I kept getting

Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

The workaround was to set CORS_ORIGIN_ALLOW_ALL to True, which I am not that happy with.

The peculiar thing was the error popped up only on the URL’s/resources when Django was trying to set some Sessions(like logging in etc.) So maybe there is a conflict in how CORS behaves on these resources on browsers?

[jordanmkoncz]

I think I ran into the same or a similar issue. I was trying to add my front-end to CORS_ORIGIN_WHITELIST and it just wasn’t working; the request always failed with the “Response to preflight request doesn’t pass access control check…” error that @parth-choudhary was getting. My front-end is only accessible via HTTPS.

I tried CORS_ORIGIN_WHITELIST = ['app.mysite.com'], and CORS_ORIGIN_WHITELIST = ['app.mysite.com', 'https://app.mysite.com'], and neither of these worked.

However, CORS_ORIGIN_WHITELIST = ['https://app.mysite.com', 'app.mysite.com'] does seem to be working correctly. So it seems like it’s necessary to include the HTTPS version of the origin, and it also must be included before the non-HTTPS version.

[adamchainz]

It isn’t being cached outside of the python process, and if you’re restarting that fine it should be working. Maybe something changed outside of Djangoland e.g. in gunicorn/nginx config?