Django Cloudflare Proxy "CSRF Verification Failed"

Question

I'm trying to proxy my Django App through Cloudflare via workers.

The setup is like so:

example.com/app/* forwards to my Django site ~everything else~ forwards to my Webflow site

So far that part is working! However, I can't get Django to accept CSRF validation.

Here are the headers for the request (scrubbed for identity purposes)

{
    'HTTP_HOST': 'fluent-spring.uc.r.appspot.com',
    'HTTP_X_FORWARDED_FOR': '70.192.78.2',
    'HTTP_X_FORWARDED_PROTO': 'https',
    'HTTP_FORWARDED': 'for="172.70.0.123";proto=https',
    'HTTP_CF_WORKER': 'example.com',
    'HTTP_UPGRADE_INSECURE_REQUESTS': '1',
    'HTTP_CF_RAY': '6d2a89b3435e8c3b-EWR',
    'HTTP_CF_VISITOR': '{"scheme":"https"}',
    'HTTP_CF_EW_VIA': '15',
    'HTTP_CDN_LOOP': 'cloudflare; subreqs=1',
    'HTTP_ACCEPT_LANGUAGE': 'en-US,en;q=0.9',
    'HTTP_ACCEPT': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
    'HTTP_CACHE_CONTROL': 'no-cache',
    'HTTP_REFERER': 'https://fluent-spring.uc.r.appspot.com/',
    'HTTP_USER_AGENT': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36',
    'HTTP_CF_CONNECTING_IP': '70.19.78.2',
    'HTTP_ORIGIN': 'https://www.example.com',
    'HTTP_PRAGMA': 'no-cache',
    'HTTP_SEC_CH_UA': '" Not;A Brand";v="99", "Google Chrome";v="97", "Chromium";v="97"',
    'HTTP_SEC_CH_UA_MOBILE': '?0',
    'HTTP_SEC_CH_UA_PLATFORM': '"macOS"',
    'HTTP_SEC_FETCH_DEST': 'document',
    'HTTP_SEC_FETCH_MODE': 'navigate',
    'HTTP_SEC_FETCH_SITE': 'same-origin',
    'HTTP_SEC_FETCH_USER': '?1',
    'HTTP_X_CLOUD_TRACE_CONTEXT': '959632cd27b84e7aad1a5e3c71f1d8a3/18242229191417730943',
    'HTTP_COOKIE': 'csrftoken=GHjnkrOrhave8EJ1eayWxxaSZiaxu5JJcJAaI1dmzc5Tdnb9T1YwaXvYUDr5ZQ83',
    'HTTP_X_APPENGINE_CITYLATLONG': '40.735657,-74.172367',
    'HTTP_X_APPENGINE_COUNTRY': 'US',
    'HTTP_X_APPENGINE_CITY': 'newark',
    'HTTP_X_APPENGINE_REGION': 'nj',
    'HTTP_TRACEPARENT': '00-959632cd27b84e7aad1a5e3c71f1d8a3-fd296acc51b7177f-00',
    'HTTP_X_APPENGINE_TIMEOUT_MS': '599998',
    'HTTP_X_APPENGINE_HTTPS': 'on',
    'HTTP_X_APPENGINE_USER_IP': '172.70.230.1',
    'HTTP_X_APPENGINE_API_TICKET': 'ChBkODIxOGU1YjRmMWE5NDlmGhMI2KyFxePK9QIVY049Ah0P8gjM',
    'HTTP_ACCEPT_ENCODING': 'gzip',
    'HTTP_X_APPENGINE_REQUEST_LOG_ID': '61eecfb100ff02c818a28bb9f40001737e666c75656e742d737072696e672d3333303332310001323032323031323474313035373136000100',
    'HTTP_X_APPENGINE_DEFAULT_VERSION_HOSTNAME': 'fluent-spring-.uc.r.appspot.com'
}

And the error I get in the logs is

Forbidden (CSRF token missing or incorrect.): /app/sadmin/login/

And on the screen is:

CSRF verification failed. Request aborted.

And my CSRF settings in my settings.py are:

CSRF_TRUSTED_ORIGINS = [
    "www.example.com",
    "example.com",
    "kevin-dot-fluent-spring.uc.r.appspot.com",
    "fluent-spring.uc.r.appspot.com",
    "localhost",
    "https://www.example.com",
    "https://example.com",
]

Answer 1

the bug ended up being in the Cloudflare proxy worker code--

the correct Cloudflare proxy worker was

addEventListener("fetch", (event) => {
  event.respondWith(handleRequest(event.request));
});

async function handleRequest(request) {
  let url = new URL(request.url);
  // where we're proxying to
  url.hostname = "fluent-spring.uc.r.appspot.com";
  const newRequest = new Request(url.href, request);
  newRequest.headers.set("Referer", url.href);
  return await fetch(newRequest);
}