Django jQuery ajax post to https fails -

i'm writing chrome extension use , post ajax calls api made django , tastypie.

get ajax calls successful , can access data. post calls failing in production because api hosted https://, in local environment works (htt://localhost:8000).

i providing correct csrf token in header. seems error happening here: https://github.com/toastdriven/django-tastypie/blob/master/tastypie/authentication.py#l259 api require referer header check call secure.

it not seem possible set in ajax headers referer value directly, if name of header starts x-.

thanks in advance solutions or tips solve issue.

maxime.

the reason check explained in original source of method:

# suppose user visits http://example.com/ # active network attacker (man-in-the-middle, mitm) sends # post form targets https://example.com/detonate-bomb/ , # submits via javascript. # # attacker need provide csrf cookie , token, # that's no problem mitm , session-independent # nonce we're using. mitm can circumvent csrf # protection. true http connection, # using https expects better! reason, # https://example.com/ need additional protection treats # http://example.com/ untrusted. under https, # barth et al. found referer header missing # same-domain requests in 0.2% of cases or less, # can use strict referer checking. 

so, may or may not benefit referrer check - it's decide.

if wish override it, set models authenticate using subclass of sessionauthentication, , override is_authenticated(self, request, **kwargs) function needs. original method quite succinct, i'd copy-paste , remove offending if request.is_secure(): block rather tricking superclass thinking request has referrer.