So you put a Django app behind a reverse proxy that handles HTTPS (nginx, Traefik, Caddy, a PaaS router, a load balancer), open /admin/ , type the right username and password, and get this:

Forbidden (403) CSRF verification failed. Request aborted.

Origin checking failed - https://myapp.example does not match any trusted origins.

Enter fullscreen mode

Exit fullscreen mode

The username and password are fine (checked umpteen times). Django just thinks the request came in over plain HTTP.

Why it happens

The proxy normally ends HTTPS and passes the request on to Django over HTTP, adding a header that says what the original scheme was:

X-Forwarded-Proto: https

Enter fullscreen mode

Exit fullscreen mode

Django will ignore that header unless you tell it to trust it. So request.is_secure() is False , and Django expects the browsers Origin to be http://myapp.example .…