don't override host, breaks csrf (#2959)

ewdurbin · web-flow · commit a18368a30650 · 2026-03-08T16:52:37.000-04:00
cabotage is now accepting this host header on the backend so no need to override
diff --git a/infra/cdn/main.tf b/infra/cdn/main.tf
@@ -32,7 +32,7 @@ resource "fastly_service_vcl" "python_org" {
     connect_timeout       = 1000
     first_byte_timeout    = 30000
     between_bytes_timeout = 10000
-    override_host         = var.backend_address
+    override_host         = var.subdomain == "www.test.python.org" ? "www.python.org" : null
   }
 
   backend {

Original file line number	Diff line number	Diff line change
`@@ -32,7 +32,7 @@ resource "fastly_service_vcl" "python_org" {`
`32`	`32`	`connect_timeout = 1000`
`33`	`33`	`first_byte_timeout = 30000`
`34`	`34`	`between_bytes_timeout = 10000`
`35`		`- override_host = var.backend_address`
	`35`	`+ override_host = var.subdomain == "www.test.python.org" ? "www.python.org" : null`
`36`	`36`	`}`
`37`	`37`
`38`	`38`	`backend {`