diff --git a/api/settings.py b/api/settings.py
index 145bd4b..373e24e 100644
--- a/api/settings.py
+++ b/api/settings.py
@@ -28,8 +28,10 @@ DEBUG = os.getenv("ENV") != "production"
 
 if DEBUG:
     ALLOWED_HOSTS = ["localhost", "127.0.0.1"]
+    CSRF_TRUSTED_ORIGINS = ["http://localhost:3000"]
 else:
     ALLOWED_HOSTS = ["web.xuyue.cc"]
+    CSRF_TRUSTED_ORIGINS = ["https://web.xuyue.cc"]
 
 # Application definition