18

So I'm trying to enable cross origin resource sharing in Django, so I can post to an external site, and it's easy to do when I set

response["Access-Control-Allow-Origin"]="*" 

but I want to instead have it check whether the origin is in an allowed list of origins (essentially to restrict it to only allow specific sites) but I can't seem to find anywhere in the Django request where I can get the origin information.

I tried using request.META['HTTP_HOST'] but that just returns the site that's being posted to. Does anyone know where in the Request object I can get the origin of the request?

1
  • You can find how to set this up for Django overall or for specific endpoints/views in this answer.
    – Akaisteph7
    Sep 11, 2023 at 16:27

7 Answers 7

31

As for getting the url from request (which is what I was looking for), use request.META['HTTP_REFERER'] instead.

5
  • 3
    this returns a KeyError Mar 8, 2016 at 15:58
  • 2
    What version of Django are you using? What do you get if you print request.META.keys()? Here's the documentation on the request meta: docs.djangoproject.com/en/1.9/ref/request-response/…
    – ZAD-Man
    Mar 8, 2016 at 17:40
  • @ZAD-Man its possible he is experiencing KeyError from django tests, in which case there's no HTTP_REFERER. Anyway I'm not sure, but I think he should use REMOTE_HOST for what he want to get.
    – Ronen Ness
    Aug 11, 2016 at 0:18
  • @Ness - Ah, OK, I could see that.
    – ZAD-Man
    Aug 11, 2016 at 21:11
  • Since the 1.9 docs are no longer up, the current equivalent of my first comment's link is docs.djangoproject.com/en/4.2/ref/request-response/… Note that you can just change the version in the URL to the current version, in case 4.2 is taken down in the future.
    – ZAD-Man
    May 10, 2023 at 7:50
11

In Django,

request.headers['Origin']

answers the original question.

You can print(request.headers) to see everything available in the headers.

3

Use this:

origin = request.META.get("HTTP_ORIGIN")

This is the way django-cors-headers use it in the middleware:

2

you can get it by request.META["HTTP_ORIGIN"]

0

I strongly advice you to use django-cors-headers. It lets you to define CORS_ORIGIN_WHITELIST which is a list of allowed origins in more pythonic way.

0
0

To answer the question "Does anyone know where in the Request object I can get the origin of the request?", would the request.META['REMOTE_ADDR'] give you what you need?

1
  • Does not work, it gives an IP address, not an host name.
    – Overdrivr
    Apr 6, 2020 at 6:48
0

In Django 2.2 use:

request.META.get('HTTP_REFERER')

Make sure that the request property doesn't have mode = no-cors

see:

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin

"There are some exceptions to the above rules; for example, if a cross-origin GET or HEAD request is made in no-cors mode, the Origin header will not be added."

1
  • Do you mean that sometimes HTTP_REFERER may not contain a value ?
    – lbris
    Jul 6, 2022 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.