Document referrer sending or provide workaround about docassemble HOT 3 CLOSED

When HTTPS is used, the CSRF protection mechanism checks the referer header to see if it matches the host and throws an error if the referer is not set.

This behavior is configurable using the WTF_CSRF_SSL_STRICT configuration setting.

I am adding a docassemble configuration directive called require referer that can be used to disable this security feature in case the system administrator wants to permit users to use referer blockers.

I will update this issue when the new version of docassemble is published.

from docassemble.

I see, thank you.

from docassemble.

The require referer setting is available in version 0.1.41. See the documentation.

On https://demo.docassemble.org, I have enabled the setting require referer: False so you can test it out, at least for the next few weeks.

Even without this setting, docassemble should be compatible with browser add-ons that hide the referer only across domains. (E.g., this add-on.)

from docassemble.