Search code examples
djangocorssame-origin-policydjango-csrf

Django add exemption to Same Origin Policy (only for one site)

I am getting errors thrown from google.g.doubleclick.net when I try to load google ads on my site through plain html.

Blocked a frame with origin "https://googleads.g.doubleclick.net" from accessing a frame with origin "https://example.com". Protocols, domains, and ports must match.

Oddly enough I have a section of my site where I add some ads through javascript and that section does not throw any errors.

I read about adding a crossdomain.xml to the site root and I tried that (and also serving it with NGINX and that does not work either...

Is there any way to add an exception to django's CSRF rules, or any other way to get around this? It is driving me nuts. This error is only thrown in safari (only tried safari and chrome) but it adds a LOT to the data transfer for loading the page and I do not want things to be slowed down.

Solution

  • This has nothing to do with CSRF, but rather this has to do with the same origin policy security restriction which you can fix by implementing CORS and sending the appropriate headers.

    You can use django-cors-headers to help with this.