Django 允许的主机

Question

I want only my front.domain.com to access the django API so i updated my settings.py . When i deployed i can access the django API via curl and postman so i'm confused here is there anything i'm missing !

settings.py

DEBUG = False  # deployment

if DEBUG:
    FRONT_OFFICE_URL = 'http://127.0.0.1:4200/'
    ALLOWED_HOSTS = ['*']  # development
    CORS_ORIGIN_ALLOW_ALL = True # development
else:
    FRONT_OFFICE_URL = 'https://front.domaine.com'
    ALLOWED_HOSTS = [FRONT_OFFICE_URL ]  # deployment
    CORS_ORIGIN_WHITELIST = [FRONT_OFFICE_URL]
    CSRF_TRUSTED_ORIGINS = [FRONT_OFFICE_URL ]



INSTALLED_APPS = [
     ...
    'corsheaders',
   ]

MIDDLEWARE = [
    'corsheaders.middleware.CorsMiddleware',
     ...
   ]

Answer 1

CORS prevents browsers from accessing resources on other domains. But any other http request will not be blocked by CORS. If you need to block requests where Referer is not your domain, you can write some middleware to do that, but beware that it can easily be faked - Postman and Curl both lets you set the Referer header to any value.

If you need to secure requests to the API in Django, setting up CSRF protection is the way to go.