How to Handle CSRF for iFrames in Django with Multiple Whitelabel Sites Without Using a Domain Whitelist?

Question

I’m building a whitelabel solution using Django, where my clients can embed forms from my application within their websites using iFrames. However, I’m running into a problem with CSRF protection when the form is submitted from these external sites, resulting in a 403 Forbidden error due to "CSRF verification failed."

My Setup:

**Framework: ** Django 4.x with CSRF protection enabled. Use Case: Multiple clients embed our form (rendered via Django templates) into their websites. Users submit the form from these external domains.

Issue: Since the CSRF token relies on cookies and cross-origin policies, the CSRF token isn’t included in the form submission, leading to a verification failure.

Constraints:

No API Calls: The form is rendered server-side using Django templates, and we’re not using a frontend framework like React or Vue, so API-based solutions aren’t suitable. Dynamic Embedding: There’s no fixed number of client websites that can use the form, so maintaining a domain whitelist for CSRF exemption is not scalable. Security: I still want to maintain CSRF protection for security purposes.

What I've Tried:

Disabling CSRF Middleware: Works, but it compromises security, so it's not a viable long-term solution. Setting CSRF_COOKIE_SAMESITE to None: No effect due to cross-origin restrictions. Allowing CORS: Didn’t resolve the issue as it doesn’t apply to CSRF token validation. The Challenge: I need a scalable solution that allows forms embedded via iFrames from any client site to pass CSRF validation securely. Since we can’t predict which domains will use the form, maintaining a list of allowed domains isn't practical. The solution should handle CSRF in a secure way without needing to whitelist each client domain manually.

Questions:

1. Is there a way to dynamically pass CSRF tokens or otherwise handle cross-origin CSRF protection for iFrames in Django?

2. How can we securely handle CSRF for an unlimited number of embedding client sites without maintaining a domain whitelist?

3. Are there any Django configurations or middleware solutions designed for this type of use case? Any insights or recommendations would be greatly appreciated!