Django 'Forbidden (403) CSRF verification failed. Request aborted.' ('Origin checking failed - https://example.com does not match any trusted origins') behind an HTTPS reverse proxy or load balancer

Cause: Django's CsrfViewMiddleware checks unsafe requests (POST, PUT, PATCH, DELETE). If the browser sends an Origin header, it must match the host Django believes it is serving or an entry in CSRF_TRUSTED_ORIGINS. If there is no Origin on a secure request, the Referer must match. When a proxy terminates TLS and forwards plain HTTP, Django sees the wrong scheme (request.is_secure() is False) or a different Host, so the expected origin does not match what the browser sent. Another cause is a stale form: tokens rotate on login, so a form loaded before logging in (back button, another tab) fails until reloaded. Removing the Referer header with a no-referrer policy can break HTTPS checks too. Fix (best first): 1. Add your public origin, including the scheme, to settings: CSRF_TRUSTED_ORIGINS = ["https://www.example.com"]. A bare hostname without https:// is not a valid entry. Subdomain wildcards such as "https://*.example.com" are supported. 2. Tell Django the proxy terminates TLS: SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https"), and make the proxy set X-Forwarded-Proto (for nginx: proxy_set_header X-Forwarded-Proto $scheme;). Only enable this when the proxy overwrites or strips that header from client requests, otherwise clients could spoof it. 3. Make sure the original Host header reaches Django (for nginx: proxy_set_header Host $host;) and that the hostname is in ALLOWED_HOSTS. 4. Do not drop the Origin or Referer headers in the proxy, and avoid Referrer-Policy: no-referrer on pages with forms. 5. Make sure forms include {% csrf_token %} and AJAX calls send the token header. Do not "fix" this by removing CsrfViewMiddleware or marking views csrf_exempt. Verify: load the form over HTTPS on the public URL, submit it, and confirm the POST succeeds with no 403; request.is_secure() is True in a debug view. Sources: https://docs.djangoproject.com/en/stable/ref/csrf/ https://docs.djangoproject.com/en/stable/ref/settings/