Make CSRF_TRUSTED_ORIGINS configurable

Author: alicecoordinator

.env-sample

@@ -59,6 +59,9 @@ I2P_ALIAS = ''
 I2P_LONG = ''
 LOCAL_ALIAS = ''
 
+# The name of the request header used for CSRF authentication.
+CSRF_TRUSTED_ORIGINS = 'http://localhost:12345, http://adminexample.onion'
+
 # SECURITY WARNING: keep the secret key used in production secret!
 SECRET_KEY = 'django-insecure-6^&6uw$b5^en%(cu2kc7_o)(mgpazx#j_znwlym0vxfamn2uo-'
 

robosats/settings.py

@@ -308,3 +308,6 @@
 INVOICE_AND_ESCROW_DURATION = 180
 # Time to confirm chat and confirm fiat (time to Fiat Sent confirmation) HOURS
 FIAT_EXCHANGE_DURATION = 24
+
+# The name of the request header used for CSRF authentication.
+CSRF_TRUSTED_ORIGINS = config('CSRF_TRUSTED_ORIGINS', cast=lambda v: [s.strip() for s in v.split(',')], default=[])