# Django 4.0 wildcard subdomain preventing from setting csrf token **URL:** \ **Category:** Using Django\ **Created:** [January 14, 2022, 8:37pm UTC](https://forum.djangoproject.com/t/django-4-0-wildcard-subdomain-preventing-from-setting-csrf-token/11599 "2022-01-14T20:37:06Z")\ **Posts on this page:** 9\ **Page:** 2
**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\ **Post date:** [January 18, 2022, 9:22pm UTC](https://forum.djangoproject.com/t/django-4-0-wildcard-subdomain-preventing-from-setting-csrf-token/11599/21 "2022-01-18T21:22:55Z")
If you notice the request on the right, the `GET` as identified at the top is to `localhost:8080` and _not_ to `admin.localhost:8080`. So you’re getting a response from a different “host” than that to which you are sending the request. ---
**Author:** ![codehooligan](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/codehooligan/32/7078_2.png) [@codehooligan](https://forum.djangoproject.com/u/codehooligan)\ **Post date:** [January 18, 2022, 9:33pm UTC](https://forum.djangoproject.com/t/django-4-0-wildcard-subdomain-preventing-from-setting-csrf-token/11599/22 "2022-01-18T21:33:31Z")
I’m not sure if I’m following, let me make sure we are talking about the same thing: http GET request comes from my frontend [http://admin.localhost:8080](http://admin.localhost:8080) and goes to API which is located at [http://localhost:8000/api/csrf\_cookie](http://localhost:8000/api/csrf_cookie) So are you referring to this part? ---
**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\ **Post date:** [January 18, 2022, 9:36pm UTC](https://forum.djangoproject.com/t/django-4-0-wildcard-subdomain-preventing-from-setting-csrf-token/11599/23 "2022-01-18T21:36:04Z")
I’m addressing what’s in the right side of the image you posted. At the top of the image, it reports an XHR request to [http://localhost:8080](http://localhost:8080). The response headers report that the response is coming from admin.localhost. Therefore, you’re getting a response from a different host than the host to which you issued the request. ---
**Author:** ![CodenameTim](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/codenametim/32/31507_2.png) [@CodenameTim](https://forum.djangoproject.com/u/CodenameTim)\ **Post date:** [January 18, 2022, 9:49pm UTC](https://forum.djangoproject.com/t/django-4-0-wildcard-subdomain-preventing-from-setting-csrf-token/11599/24 "2022-01-18T21:49:32Z")
@KenWhitesell I think that’s exactly what codehooligan is aiming for. They want the cookie to be shared across the subdomains. @codehooligan An odd thing about the response header is that the `Set-Cookie` header in the response is that it lacks the `domain` attribute. That should be controlled by `CSRF_COOKIE_DOMAIN`. For your example it should be `CSRF_COOKIE_DOMAIN = "localhost"` ---
**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\ **Post date:** [January 18, 2022, 9:53pm UTC](https://forum.djangoproject.com/t/django-4-0-wildcard-subdomain-preventing-from-setting-csrf-token/11599/25 "2022-01-18T21:53:56Z")
@CodenameTim I can understand the desire to _access_ cookies across domains, I’m unsure of the security issues around the ability to _set_ cookies across domains. That seems problematic to me. ---
**Author:** ![codehooligan](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/codehooligan/32/7078_2.png) [@codehooligan](https://forum.djangoproject.com/u/codehooligan)\ **Post date:** [January 18, 2022, 10:10pm UTC](https://forum.djangoproject.com/t/django-4-0-wildcard-subdomain-preventing-from-setting-csrf-token/11599/26 "2022-01-18T22:10:37Z")
@CodenameTim Just checked prod version with https and I don’t see domain attribute there as well. @KenWhitesell The cross domain was intentional here, the reason for that is frontend with dynamic/wildcard subdomain. Frontend: [http://wildcardsubdomain.localhost:8080](http://wildcardsubdomain.localhost:8080) Backend: [http://localhost:8000](http://localhost:8000) Unless I’m going wrong about all this and there is better way to serve wildcard subdomains? ---
**Author:** ![codehooligan](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/codehooligan/32/7078_2.png) [@codehooligan](https://forum.djangoproject.com/u/codehooligan)\ **Post date:** [January 18, 2022, 10:21pm UTC](https://forum.djangoproject.com/t/django-4-0-wildcard-subdomain-preventing-from-setting-csrf-token/11599/27 "2022-01-18T22:21:27Z")
Setting `CSRF_COOKIE_DOMAIN = "localhost"` as you pointed added domain attribute to the Set-Cookie header, but didn’t help with setting csrf. ---
**Author:** ![codehooligan](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/codehooligan/32/7078_2.png) [@codehooligan](https://forum.djangoproject.com/u/codehooligan)\ **Post date:** [January 18, 2022, 10:28pm UTC](https://forum.djangoproject.com/t/django-4-0-wildcard-subdomain-preventing-from-setting-csrf-token/11599/28 "2022-01-18T22:28:42Z")
@CodenameTim I just added `CSRF_COOKIE_DOMAIN = "test.com"` to my prod version with https and nginx and it seem like it worked! I’m gonna do some further testing just to make sure! ---
**Author:** ![codehooligan](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/codehooligan/32/7078_2.png) [@codehooligan](https://forum.djangoproject.com/u/codehooligan)\ **Post date:** [January 19, 2022, 5:02am UTC](https://forum.djangoproject.com/t/django-4-0-wildcard-subdomain-preventing-from-setting-csrf-token/11599/29 "2022-01-19T05:02:59Z")
Thank you both @KenWhitesell && @CodenameTim for taking a time to help me with my problem! @CodenameTim your pointer to set `CSRF_COOKIE_DOMAIN` finally did a trick in my prod environment, since dev is slightly different(no nginx) it’s not working yet but will investigate it later, at least i know it’s doable. Bellow settings that worked for me: ```auto ALLOWED_HOSTS = ["." + os.environ.get("DOMAIN_NAME")] CORS_ALLOWED_ORIGIN_REGEXES = [r"https://\w+\.".format(os.environ.get("DOMAIN_NAME"))] CORS_ALLOW_CREDENTIALS = True CSRF_COOKIE_HTTPONLY = False CSRF_COOKIE_SECURE = True CSRF_COOKIE_DOMAIN = os.environ.get("DOMAIN_NAME") CSRF_TRUSTED_ORIGINS = [ "https://*." + os.environ.get("DOMAIN_NAME"), ] SESSION_COOKIE_SECURE = True SESSION_COOKIE_DOMAIN = os.environ.get("DOMAIN_NAME") SESSION_COOKIE_HTTPONLY = True ``` [Previous page](https://forum.djangoproject.com/t/django-4-0-wildcard-subdomain-preventing-from-setting-csrf-token/11599.md?page=1)